Mapping a web surface

A useful web map explains what the application does and which boundaries matter. A long URL list cannot tell you whether a parent may read a student’s grades or whether an old export service still contains private records.

Map both reads and changes

Record the feature, method, data sensitivity, allowed roles, tenant relationship, and dependencies. A read-only export can expose an entire customer history. A public address change can alter deliveries. Confidentiality and integrity both matter; state-changing requests are not the only valuable rows.

Separate sources from conclusions

Owner-provided inventories, application documentation, ordinary browser activity, and approved code review reveal different portions of a system. Sitemaps and robots.txt describe crawler-facing information. Certificate Transparency records certificate issuance, not current ownership or permission to examine a host.

A documented endpoint may be retired; an undocumented one may be legitimate. Record the source, date, and uncertainty instead of silently treating every name as a live service.

A response is evidence with alternatives

403 does not prove that a particular application resource exists. A gateway might reject every request to that prefix. 404 can conceal a resource, while 200 can carry an application-level error. Length and timing also vary for harmless reasons.

Compare these observations with documentation, configuration, and application logs available to the reviewer. A pattern can justify investigation without justifying a vulnerability claim. Likewise, a server accepting DNS zone transfers is a policy issue only when that disclosure is unintended; authorized replication is normal.

Scenario: the forgotten report

A school adds a new dashboard but keeps its older report service. The map shows that both handle grades, yet only the dashboard’s authorization policy has been reviewed. The useful next decision is to assign an owner and review the report service’s access rules and retention.

Finding a parameter name does not itself prove mass assignment. That requires inappropriate binding of client-controlled properties to sensitive state. APIs develops that distinction.

Make coverage understandable

Mark each row as reviewed, not yet reviewed, or outside this review, with a reason. Prioritize sensitive data, broad permissions, shared infrastructure, and unsupported dependencies. Keep unresolved questions visible. Coverage is bounded evidence, not a promise that every possible behavior has been examined.

Build a map that can support a decision

The fictional school gives you three records. Its service list says the new dashboard replaced the old report tool. A current deployment record still lists the report service. The data owner confirms that both services can read grades. These records disagree about retirement; they do not establish an access-control failure.

Create a small coverage map:

The report deserves early attention because it combines sensitive data with missing policy evidence. That is a reason for priority, not a severity rating or a claim that grades leaked. The public calendar remains in the map; lower priority does not mean it has no dependencies or no possible risk.

PredictA dashboard review passed. Can the grade-report row inherit its reviewed status?

Only if evidence establishes that the relevant controls and paths are shared and covered. A common database is not enough: the report may have a different audience, filter, service identity, or export path.

Make each row traceable to its evidence and date. Record the intended audience, read or change operation, sensitive data, application owner, and dependencies. Put unresolved retirement beside the record that contradicted it. A future reviewer can then update the map without reconstructing your assumptions.

Coverage needs a denominator: three mapped features with one access policy reviewed is different from one URL returning success. State the boundaries of the review and what would move each unfinished row to reviewed, such as owner-approved rules plus results for the relevant roles.