Model components, zones and data flows. The tool highlights security questions at every boundary and exports a portable Mermaid diagram. Nothing is uploaded.
Components and trust zones
Untrusted client
Mobile app
Public edge
API gateway
Private backend
Database
Data flows
Mobile app → API gateway: Authenticated request
API gateway → Database: Authorized query
Boundary review prompts
Mobile app → API gateway: Crossing Untrusted client / Public edge. Verify identity, authorization, input constraints, replay policy and observability for Authenticated request.
API gateway → Database: Crossing Public edge / Private backend. Verify identity, authorization, input constraints, replay policy and observability for Authorized query.
Exportable Mermaid
flowchart LR
app["Mobile app (Untrusted client)"]
api["API gateway (Public edge)"]
store["Database (Private backend)"]
app -->|Authenticated request| api
api -->|Authorized query| store
The tool identifies zone crossings to review; it cannot assess actual deployed controls. Models stay in memory until you export them. Do not add sensitive architecture or credentials to shared exports.
