[{"data":1,"prerenderedAt":980},["ShallowReactive",2],{"-docs-guide-methodology":3,"-docs-guide-methodology-surround":967},{"id":4,"title":5,"body":6,"description":957,"extension":958,"links":959,"meta":960,"navigation":961,"path":963,"seo":964,"stem":965,"__hash__":966},"docs\u002Fdocs\u002F2.guide\u002F7.methodology.md","How to author an audit methodology",{"type":7,"value":8,"toc":948},"minimark",[9,13,18,47,51,59,86,89,93,117,726,740,744,747,778,781,785,792,863,869,873,900,918,929,933,936,944],[10,11,12],"p",{},"A methodology determines which questions TheSpider asks each enabled model. You author it as an immutable project configuration version in the web application.",[14,15,17],"h2",{"id":16},"prerequisites","Prerequisites",[19,20,21,34,44],"ul",{},[22,23,24,25,29,30,33],"li",{},"You have the ",[26,27,28],"code",{},"admin"," or ",[26,31,32],{},"owner"," role.",[22,35,36,37,29,40,43],{},"The project exists in ",[26,38,39],{},"security",[26,41,42],{},"bugs"," mode.",[22,45,46],{},"The server model catalog contains the model code you plan to run.",[14,48,50],{"id":49},"design-the-coverage-matrix","Design the coverage matrix",[10,52,53,54,58],{},"TheSpider creates work from ",[55,56,57],"strong",{},"buckets × passes × enabled models",".",[19,60,61,68,74,80],{},[22,62,63,64,67],{},"A ",[55,65,66],{},"bucket"," is a review area, such as authentication or data integrity.",[22,69,63,70,73],{},[55,71,72],{},"category"," is a report classification that can belong to one or more buckets.",[22,75,63,76,79],{},[55,77,78],{},"pass"," is an audit perspective with a repository scope.",[22,81,63,82,85],{},[55,83,84],{},"prompt section"," supplies shared instructions, a severity or impact rubric, and the output contract.",[10,87,88],{},"Start with two or three buckets and two focused passes. A larger matrix costs more model runs and often repeats evidence without improving coverage.",[14,90,92],{"id":91},"author-the-configuration","Author the configuration",[94,95,96,99,105,110],"ol",{},[22,97,98],{},"Open the project.",[22,100,101,102,58],{},"Select ",[55,103,104],{},"Config",[22,106,101,107,58],{},[55,108,109],{},"Author new version",[22,111,112,113,116],{},"Replace ",[26,114,115],{},"config_json"," with a configuration like this:",[118,119,124],"pre",{"className":120,"code":121,"language":122,"meta":123,"style":123},"language-json shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","{\n  \"name\": \"Web API review\",\n  \"buckets\": [\n    {\n      \"code\": \"auth\",\n      \"name\": \"Authentication and authorization\",\n      \"description\": \"Identity, session, and permission boundaries\",\n      \"categories\": [\"authn\", \"authz\"]\n    },\n    {\n      \"code\": \"data\",\n      \"name\": \"Data integrity\",\n      \"description\": \"Validation, persistence, and transaction boundaries\",\n      \"categories\": [\"validation\"]\n    }\n  ],\n  \"categories\": [\n    { \"code\": \"authn\", \"name\": \"Authentication\" },\n    { \"code\": \"authz\", \"name\": \"Authorization\" },\n    { \"code\": \"validation\", \"name\": \"Input validation\" }\n  ],\n  \"passes\": [\n    {\n      \"code\": \"http\",\n      \"name\": \"HTTP surface\",\n      \"description\": \"Trace untrusted requests through authorization and validation\",\n      \"scope\": \"src\u002Fhttp src\u002Froutes\"\n    },\n    {\n      \"code\": \"storage\",\n      \"name\": \"Persistence\",\n      \"description\": \"Review queries, transactions, and tenant boundaries\",\n      \"scope\": \"src\u002Fdb migrations\u002F**\u002F*.sql\"\n    }\n  ]\n}\n","json","",[26,125,126,135,163,178,184,206,226,247,282,288,293,313,333,353,375,381,387,400,440,478,517,522,536,541,561,581,601,621,626,631,651,671,691,709,714,720],{"__ignoreMap":123},[127,128,131],"span",{"class":129,"line":130},"line",1,[127,132,134],{"class":133},"sMK4o","{\n",[127,136,138,141,145,148,151,154,158,160],{"class":129,"line":137},2,[127,139,140],{"class":133},"  \"",[127,142,144],{"class":143},"spNyl","name",[127,146,147],{"class":133},"\"",[127,149,150],{"class":133},":",[127,152,153],{"class":133}," \"",[127,155,157],{"class":156},"sfazB","Web API review",[127,159,147],{"class":133},[127,161,162],{"class":133},",\n",[127,164,166,168,171,173,175],{"class":129,"line":165},3,[127,167,140],{"class":133},[127,169,170],{"class":143},"buckets",[127,172,147],{"class":133},[127,174,150],{"class":133},[127,176,177],{"class":133}," [\n",[127,179,181],{"class":129,"line":180},4,[127,182,183],{"class":133},"    {\n",[127,185,187,190,193,195,197,199,202,204],{"class":129,"line":186},5,[127,188,189],{"class":133},"      \"",[127,191,26],{"class":192},"sBMFI",[127,194,147],{"class":133},[127,196,150],{"class":133},[127,198,153],{"class":133},[127,200,201],{"class":156},"auth",[127,203,147],{"class":133},[127,205,162],{"class":133},[127,207,209,211,213,215,217,219,222,224],{"class":129,"line":208},6,[127,210,189],{"class":133},[127,212,144],{"class":192},[127,214,147],{"class":133},[127,216,150],{"class":133},[127,218,153],{"class":133},[127,220,221],{"class":156},"Authentication and authorization",[127,223,147],{"class":133},[127,225,162],{"class":133},[127,227,229,231,234,236,238,240,243,245],{"class":129,"line":228},7,[127,230,189],{"class":133},[127,232,233],{"class":192},"description",[127,235,147],{"class":133},[127,237,150],{"class":133},[127,239,153],{"class":133},[127,241,242],{"class":156},"Identity, session, and permission boundaries",[127,244,147],{"class":133},[127,246,162],{"class":133},[127,248,250,252,255,257,259,262,264,267,269,272,274,277,279],{"class":129,"line":249},8,[127,251,189],{"class":133},[127,253,254],{"class":192},"categories",[127,256,147],{"class":133},[127,258,150],{"class":133},[127,260,261],{"class":133}," [",[127,263,147],{"class":133},[127,265,266],{"class":156},"authn",[127,268,147],{"class":133},[127,270,271],{"class":133},",",[127,273,153],{"class":133},[127,275,276],{"class":156},"authz",[127,278,147],{"class":133},[127,280,281],{"class":133},"]\n",[127,283,285],{"class":129,"line":284},9,[127,286,287],{"class":133},"    },\n",[127,289,291],{"class":129,"line":290},10,[127,292,183],{"class":133},[127,294,296,298,300,302,304,306,309,311],{"class":129,"line":295},11,[127,297,189],{"class":133},[127,299,26],{"class":192},[127,301,147],{"class":133},[127,303,150],{"class":133},[127,305,153],{"class":133},[127,307,308],{"class":156},"data",[127,310,147],{"class":133},[127,312,162],{"class":133},[127,314,316,318,320,322,324,326,329,331],{"class":129,"line":315},12,[127,317,189],{"class":133},[127,319,144],{"class":192},[127,321,147],{"class":133},[127,323,150],{"class":133},[127,325,153],{"class":133},[127,327,328],{"class":156},"Data integrity",[127,330,147],{"class":133},[127,332,162],{"class":133},[127,334,336,338,340,342,344,346,349,351],{"class":129,"line":335},13,[127,337,189],{"class":133},[127,339,233],{"class":192},[127,341,147],{"class":133},[127,343,150],{"class":133},[127,345,153],{"class":133},[127,347,348],{"class":156},"Validation, persistence, and transaction boundaries",[127,350,147],{"class":133},[127,352,162],{"class":133},[127,354,356,358,360,362,364,366,368,371,373],{"class":129,"line":355},14,[127,357,189],{"class":133},[127,359,254],{"class":192},[127,361,147],{"class":133},[127,363,150],{"class":133},[127,365,261],{"class":133},[127,367,147],{"class":133},[127,369,370],{"class":156},"validation",[127,372,147],{"class":133},[127,374,281],{"class":133},[127,376,378],{"class":129,"line":377},15,[127,379,380],{"class":133},"    }\n",[127,382,384],{"class":129,"line":383},16,[127,385,386],{"class":133},"  ],\n",[127,388,390,392,394,396,398],{"class":129,"line":389},17,[127,391,140],{"class":133},[127,393,254],{"class":143},[127,395,147],{"class":133},[127,397,150],{"class":133},[127,399,177],{"class":133},[127,401,403,406,408,410,412,414,416,418,420,422,424,426,428,430,432,435,437],{"class":129,"line":402},18,[127,404,405],{"class":133},"    {",[127,407,153],{"class":133},[127,409,26],{"class":192},[127,411,147],{"class":133},[127,413,150],{"class":133},[127,415,153],{"class":133},[127,417,266],{"class":156},[127,419,147],{"class":133},[127,421,271],{"class":133},[127,423,153],{"class":133},[127,425,144],{"class":192},[127,427,147],{"class":133},[127,429,150],{"class":133},[127,431,153],{"class":133},[127,433,434],{"class":156},"Authentication",[127,436,147],{"class":133},[127,438,439],{"class":133}," },\n",[127,441,443,445,447,449,451,453,455,457,459,461,463,465,467,469,471,474,476],{"class":129,"line":442},19,[127,444,405],{"class":133},[127,446,153],{"class":133},[127,448,26],{"class":192},[127,450,147],{"class":133},[127,452,150],{"class":133},[127,454,153],{"class":133},[127,456,276],{"class":156},[127,458,147],{"class":133},[127,460,271],{"class":133},[127,462,153],{"class":133},[127,464,144],{"class":192},[127,466,147],{"class":133},[127,468,150],{"class":133},[127,470,153],{"class":133},[127,472,473],{"class":156},"Authorization",[127,475,147],{"class":133},[127,477,439],{"class":133},[127,479,481,483,485,487,489,491,493,495,497,499,501,503,505,507,509,512,514],{"class":129,"line":480},20,[127,482,405],{"class":133},[127,484,153],{"class":133},[127,486,26],{"class":192},[127,488,147],{"class":133},[127,490,150],{"class":133},[127,492,153],{"class":133},[127,494,370],{"class":156},[127,496,147],{"class":133},[127,498,271],{"class":133},[127,500,153],{"class":133},[127,502,144],{"class":192},[127,504,147],{"class":133},[127,506,150],{"class":133},[127,508,153],{"class":133},[127,510,511],{"class":156},"Input validation",[127,513,147],{"class":133},[127,515,516],{"class":133}," }\n",[127,518,520],{"class":129,"line":519},21,[127,521,386],{"class":133},[127,523,525,527,530,532,534],{"class":129,"line":524},22,[127,526,140],{"class":133},[127,528,529],{"class":143},"passes",[127,531,147],{"class":133},[127,533,150],{"class":133},[127,535,177],{"class":133},[127,537,539],{"class":129,"line":538},23,[127,540,183],{"class":133},[127,542,544,546,548,550,552,554,557,559],{"class":129,"line":543},24,[127,545,189],{"class":133},[127,547,26],{"class":192},[127,549,147],{"class":133},[127,551,150],{"class":133},[127,553,153],{"class":133},[127,555,556],{"class":156},"http",[127,558,147],{"class":133},[127,560,162],{"class":133},[127,562,564,566,568,570,572,574,577,579],{"class":129,"line":563},25,[127,565,189],{"class":133},[127,567,144],{"class":192},[127,569,147],{"class":133},[127,571,150],{"class":133},[127,573,153],{"class":133},[127,575,576],{"class":156},"HTTP surface",[127,578,147],{"class":133},[127,580,162],{"class":133},[127,582,584,586,588,590,592,594,597,599],{"class":129,"line":583},26,[127,585,189],{"class":133},[127,587,233],{"class":192},[127,589,147],{"class":133},[127,591,150],{"class":133},[127,593,153],{"class":133},[127,595,596],{"class":156},"Trace untrusted requests through authorization and validation",[127,598,147],{"class":133},[127,600,162],{"class":133},[127,602,604,606,609,611,613,615,618],{"class":129,"line":603},27,[127,605,189],{"class":133},[127,607,608],{"class":192},"scope",[127,610,147],{"class":133},[127,612,150],{"class":133},[127,614,153],{"class":133},[127,616,617],{"class":156},"src\u002Fhttp src\u002Froutes",[127,619,620],{"class":133},"\"\n",[127,622,624],{"class":129,"line":623},28,[127,625,287],{"class":133},[127,627,629],{"class":129,"line":628},29,[127,630,183],{"class":133},[127,632,634,636,638,640,642,644,647,649],{"class":129,"line":633},30,[127,635,189],{"class":133},[127,637,26],{"class":192},[127,639,147],{"class":133},[127,641,150],{"class":133},[127,643,153],{"class":133},[127,645,646],{"class":156},"storage",[127,648,147],{"class":133},[127,650,162],{"class":133},[127,652,654,656,658,660,662,664,667,669],{"class":129,"line":653},31,[127,655,189],{"class":133},[127,657,144],{"class":192},[127,659,147],{"class":133},[127,661,150],{"class":133},[127,663,153],{"class":133},[127,665,666],{"class":156},"Persistence",[127,668,147],{"class":133},[127,670,162],{"class":133},[127,672,674,676,678,680,682,684,687,689],{"class":129,"line":673},32,[127,675,189],{"class":133},[127,677,233],{"class":192},[127,679,147],{"class":133},[127,681,150],{"class":133},[127,683,153],{"class":133},[127,685,686],{"class":156},"Review queries, transactions, and tenant boundaries",[127,688,147],{"class":133},[127,690,162],{"class":133},[127,692,694,696,698,700,702,704,707],{"class":129,"line":693},33,[127,695,189],{"class":133},[127,697,608],{"class":192},[127,699,147],{"class":133},[127,701,150],{"class":133},[127,703,153],{"class":133},[127,705,706],{"class":156},"src\u002Fdb migrations\u002F**\u002F*.sql",[127,708,620],{"class":133},[127,710,712],{"class":129,"line":711},34,[127,713,380],{"class":133},[127,715,717],{"class":129,"line":716},35,[127,718,719],{"class":133},"  ]\n",[127,721,723],{"class":129,"line":722},36,[127,724,725],{"class":133},"}\n",[10,727,728,729,731,732,734,735,737,738,58],{},"Each bucket and pass requires a non-empty ",[26,730,26],{}," and ",[26,733,144],{},". Each pass also requires a non-empty ",[26,736,608],{},". Categories are optional, but category codes referenced by a bucket must exist in ",[26,739,254],{},[14,741,743],{"id":742},"define-pass-scopes","Define pass scopes",[10,745,746],{},"A scope is a space-separated list of paths or glob tokens.",[19,748,749,759,772],{},[22,750,751,752,755,756,58],{},"A plain token matches an exact path or directory prefix. ",[26,753,754],{},"src\u002Fhttp"," matches files below ",[26,757,758],{},"src\u002Fhttp\u002F",[22,760,761,764,765,768,769,58],{},[26,762,763],{},"*"," matches across path separators. ",[26,766,767],{},"src\u002F*.ts"," also matches ",[26,770,771],{},"src\u002Fsub\u002Fapp.ts",[22,773,774,777],{},[26,775,776],{},"?"," matches one character.",[10,779,780],{},"Incremental campaigns select passes whose scope matches a changed path. Changes to dependency, lock, container, environment, and framework configuration files expand an incremental campaign to every pass because those files can affect the whole project.",[14,782,784],{"id":783},"add-prompt-sections","Add prompt sections",[10,786,787,788,791],{},"Set ",[26,789,790],{},"prompt_sections"," to a filename-to-Markdown object:",[118,793,795],{"className":120,"code":794,"language":122,"meta":123,"style":123},"{\n  \"global.md\": \"Audit only the bucket and pass in this slice. Report concrete, evidence-backed defects with exact file paths.\",\n  \"severity_rubric.md\": \"Rate security findings as critical, high, medium, low, or info. In bug mode, interpret the same values as impact.\",\n  \"output_schema.md\": \"Emit a JSON array between \u003CTHESPIDER_FINDINGS_JSON> and \u003C\u002FTHESPIDER_FINDINGS_JSON>.\"\n}\n",[26,796,797,801,821,841,859],{"__ignoreMap":123},[127,798,799],{"class":129,"line":130},[127,800,134],{"class":133},[127,802,803,805,808,810,812,814,817,819],{"class":129,"line":137},[127,804,140],{"class":133},[127,806,807],{"class":143},"global.md",[127,809,147],{"class":133},[127,811,150],{"class":133},[127,813,153],{"class":133},[127,815,816],{"class":156},"Audit only the bucket and pass in this slice. Report concrete, evidence-backed defects with exact file paths.",[127,818,147],{"class":133},[127,820,162],{"class":133},[127,822,823,825,828,830,832,834,837,839],{"class":129,"line":165},[127,824,140],{"class":133},[127,826,827],{"class":143},"severity_rubric.md",[127,829,147],{"class":133},[127,831,150],{"class":133},[127,833,153],{"class":133},[127,835,836],{"class":156},"Rate security findings as critical, high, medium, low, or info. In bug mode, interpret the same values as impact.",[127,838,147],{"class":133},[127,840,162],{"class":133},[127,842,843,845,848,850,852,854,857],{"class":129,"line":180},[127,844,140],{"class":133},[127,846,847],{"class":143},"output_schema.md",[127,849,147],{"class":133},[127,851,150],{"class":133},[127,853,153],{"class":133},[127,855,856],{"class":156},"Emit a JSON array between \u003CTHESPIDER_FINDINGS_JSON> and \u003C\u002FTHESPIDER_FINDINGS_JSON>.",[127,858,620],{"class":133},[127,860,861],{"class":129,"line":186},[127,862,725],{"class":133},[10,864,865,866,868],{},"Keep the marker in ",[26,867,847],{}," aligned with the configured prompt marker. The server renders these sections into every slice prompt and parses the model's raw stdout using that marker.",[14,870,872],{"id":871},"create-and-verify-the-version","Create and verify the version",[94,874,875,880,883,890,897],{},[22,876,101,877,58],{},[55,878,879],{},"Create version",[22,881,882],{},"Confirm that the Config page shows the new version and every prompt section.",[22,884,885,886,889],{},"Check the ",[55,887,888],{},"Coverage lenses"," value. It shows buckets × passes before model fan-out.",[22,891,892,893,896],{},"Open ",[55,894,895],{},"Settings"," and enable at least one model for the project.",[22,898,899],{},"Run one bounded batch:",[118,901,905],{"className":902,"code":903,"language":904,"meta":123,"style":123},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","thespider-agent run --once\n","bash",[26,906,907],{"__ignoreMap":123},[127,908,909,912,915],{"class":129,"line":130},[127,910,911],{"class":192},"thespider-agent",[127,913,914],{"class":156}," run",[127,916,917],{"class":156}," --once\n",[10,919,892,920,923,924,58],{},[55,921,922],{},"Slices"," and confirm the slice completed and imported reports. If a runner produced output but\nno reports, use the ",[925,926,928],"a",{"href":927},"\u002Fdocs\u002Fguide\u002Ftroubleshooting","runner troubleshooting catalog",[14,930,932],{"id":931},"version-behavior","Version behavior",[10,934,935],{},"Configuration versions are immutable. A campaign stays pinned to the version it started with. Author another version to change coverage or prompt semantics; do not expect an in-flight campaign to adopt the new version.",[10,937,938,939,943],{},"Continue with ",[925,940,942],{"href":941},"\u002Fdocs\u002Fguide\u002Faudit-workflows","audit workflows"," to choose full, incremental, and retest campaign cadence.",[945,946,947],"style",{},"html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html pre.shiki code .spNyl, html code.shiki .spNyl{--shiki-light:#9C3EDA;--shiki-default:#C792EA;--shiki-dark:#C792EA}",{"title":123,"searchDepth":137,"depth":137,"links":949},[950,951,952,953,954,955,956],{"id":16,"depth":137,"text":17},{"id":49,"depth":137,"text":50},{"id":91,"depth":137,"text":92},{"id":742,"depth":137,"text":743},{"id":783,"depth":137,"text":784},{"id":871,"depth":137,"text":872},{"id":931,"depth":137,"text":932},"Define buckets, categories, passes, scopes, and prompt sections for a project","md",null,{},{"icon":962},"i-lucide-panels-top-left","\u002Fdocs\u002Fguide\u002Fmethodology",{"title":5,"description":957},"docs\u002F2.guide\u002F7.methodology","ixklYzoLZykMismLv92LKllXJNuPfBKvd6SpYjMNAac",[968,974],{"title":969,"path":970,"stem":971,"description":972,"icon":973,"children":-1},"Data handling & privacy","\u002Fdocs\u002Fguide\u002Fdata-handling","docs\u002F2.guide\u002F6.data-handling","What TheSpider transmits, stores, scrubs, and leaves to deployment policy","i-lucide-shield-check",{"title":975,"path":976,"stem":977,"description":978,"icon":979,"children":-1},"How to configure a custom model runner","\u002Fdocs\u002Fguide\u002Fcustom-runner","docs\u002F2.guide\u002F8.custom-runner","Bind a local model command to TheSpider's prompt and result contract","i-lucide-terminal-square",1784724165141]