8bc529ef2d
Some checks failed
CI — Test & Build / Test & Build (push) Has been cancelled
- Implemented a status bar item for LexAI with dynamic status updates (ready, processing, notReady). - Created a suggestion panel for displaying and interacting with AI-generated suggestions. - Added functionality for accepting, regenerating, and discarding suggestions within the suggestion zone. - Introduced configuration options for writing style, prompt patterns, personas, and formats. - Integrated progress indicators for long-running tasks and improved user feedback. - Established TypeScript configuration for the vscode package.
32 lines
1.2 KiB
Markdown
32 lines
1.2 KiB
Markdown
# Attack surface
|
|
|
|
> Living inventory of everything this project has deployed and its exposure. Updated whenever infrastructure changes and before each security review, via the `attack-surface` skill. Contains **no secrets** — only references to where secrets live.
|
|
|
|
## Assets
|
|
|
|
| Asset | Type | Tech / version | Hosted | Auth in | Exposure | Defenses | Review cadence |
|
|
| --- | --- | --- | --- | --- | --- | --- | --- |
|
|
| _[none mapped yet]_ | | | | | | | |
|
|
|
|
## Per-asset notes
|
|
|
|
<!--
|
|
### [asset name]
|
|
- **Common misconfigs / CVE classes:** [platform-specific]
|
|
- **Known exposure:** [what an attacker reaches, and from where]
|
|
- **Secrets location:** [vault / secret-manager path — never the value]
|
|
- **Last reviewed:** [date + result]
|
|
-->
|
|
|
|
## Model / harness input surface
|
|
|
|
Injection-relevant inputs to model calls (kept in sync by the `prompt-injection-audit` skill).
|
|
|
|
| Input avenue | Consuming model | Reachable tools | Exposure | Defense in place |
|
|
| --- | --- | --- | --- | --- |
|
|
| _[e.g. web fetch results]_ | | | | |
|
|
|
|
## Gaps / unknowns
|
|
|
|
- Inventory not yet populated. Run the `attack-surface` skill once real infrastructure exists, and `prompt-injection-audit` once the app makes model-driven tool calls.
|