Security Review Portfolio

AI & Azure Security Architecture · Public Edition

Application Source Code & AI/LLM Security Review

A public methodology report showing how AI/LLM threats, bounded model controls, adversarial regression, application boundaries, safe file and output handling, and software supply-chain risks can be assessed as one connected application.

Audience Engineering, product security and AI leaders Evidence Source, repository and tool output Coverage AI/LLM, regression, application and supply-chain security Companion Azure deployment review Formats Chaptered · single page for reading or print

Informed by OWASP LLM Top 10 OWASP Top 10 / ASVS NIST AI RMF (GenAI Profile) MITRE ATLAS / CWE Microsoft Zero Trust

Section 1

Executive Summary

AI-enabled application security is a system property. Reviewing AI services, model inputs and outputs, frontend, API, worker, infrastructure and dependencies in isolation can miss the attack paths created at their seams.

This review method joins AI/LLM threat modeling, bounded model controls, adversarial regression, source inspection, repository analysis and software-supply-chain checks. It treats user input, uploaded documents, retrieved content and model output as untrusted until deterministic application controls validate and authorize the next action.

Assessment principle. The model can assist with classification or judgment, but identity, authorization, schemas, permitted actions and high-impact approvals belong to deterministic application code.

Section 2

Scope and Reviewed Technology

The reviewed application pattern combines Azure AI document understanding and model-assisted processing (Azure AI Document Intelligence and Azure OpenAI in Azure AI Foundry) with a React and TypeScript web application, Python 3.12 and FastAPI APIs, an asynchronous Python worker, Docker, Bicep and Azure DevOps.

Supporting Azure services include application hosting on Azure Container Apps, Azure App Configuration, Azure Blob and Queue Storage, an operational document database on Azure Cosmos DB, a dedicated secret store in Azure Key Vault and centralized monitoring with Azure Monitor.

The reviewed flow (illustrative)

Click or tap a zone or checkpoint on the diagram to jump to the related illustrative security examples.

Sequence diagram of the illustrative document-processing flow: upload and intake, conversion under budgets, AI analysis at the untrusted-content boundary, bounded output handling, human review and assembly, and telemetry, with a security checkpoint annotated at each hop.
The illustrative document-processing flow with a security checkpoint at every hop. Fictional and representative; the lifeline groups follow the review's four boundaries. See also the reference architecture in the Azure review.

Review lenses per component

Component What the review examines Representative risks (Microsoft-documented)
React + TypeScript frontend Authentication flows, token storage and configuration exposure Script-readable token storage; backend-only configuration reaching the browser
FastAPI API Authentication and authorization per operation, contracts and error handling Missing object-level authorization; mass assignment through permissive contracts; detailed errors reaching callers
Async Python worker Queue trust, identity scope and processing isolation Unauthenticated or replayable work items; one identity spanning many data scopes
File ingestion and conversion Format validation and resource budgets Unbounded conversion of attacker-controlled files ahead of paid processing
Azure AI Document Intelligence + Azure OpenAI Prompt construction, output handling and callback trust Document-borne instructions steering the model; free-form output reaching persistent records; unvalidated callback addresses
Dependencies (pip-audit, npm audit) Known vulnerabilities prioritized by data exposure Vulnerable packages on the client-data path; unpinned transitive dependencies
Containers (Trivy) Image contents, base layers and runtime user Vulnerable base images; containers running as root; stale digests
Delivery (Azure DevOps) [planned] The designed pipeline: scans, gates, identities and rollback Secrets in repository history; mutable image references; missing approval gates

Review lenses are generic and drawn from Microsoft security-baseline and Well-Architected guidance. Representative risks are typical finding categories for each component, not engagement findings.

Section 3

Methodology

  1. Trace critical flows. Follow user and document actions across browser, API, worker, storage and AI boundaries.
  2. Review enforcement points. Locate authentication, authorization, validation, error handling and service access in code.
  3. Assess dependencies. Compare locked packages and container inputs with public vulnerability data.
  4. Threat-model AI behavior. Examine direct and indirect prompt injection, disclosure, unsafe output and excessive agency.
  5. Challenge observations. Use complementary model roles and human review to test evidence and confidence.
  6. Define verification. Give accepted remediation work an observable completion condition rather than a prose recommendation alone.

Section 4

Control Domains and Examples at a Glance

Each control domain has its own page with worked, explicitly fictional severity examples. The table lists every example for quick scanning.

Severity Illustrative example (fictional) Control domain
Critical Document-Borne Instructions Influence Cross-Customer Data Access AI and LLM Threat Model
High Model and Error Paths Disclose Sensitive Document Content AI and LLM Threat Model
Medium Untrusted Document Text Alters Classification Behaviour AI and LLM Threat Model
Critical Model Output Can Select an Unapproved Downstream Action Adversarial Regression and Guardrail Drift
High Free-Form Model Output Reaches Persistent Records Adversarial Regression and Guardrail Drift
Medium Prompt Changes Ship Without Adversarial Regression Evidence Adversarial Regression and Guardrail Drift
Critical Signed-In Users Can Cross Customer Record Boundaries Application and Service Boundaries
High Privileged API Operations Lack Role Enforcement Application and Service Boundaries
Medium Record Updates Accept Fields the Caller Should Not Control Application and Service Boundaries
Critical Active Uploaded Content Runs Inside a Trusted Staff Session Files, APIs and Safe Output Handling
High Document Conversion Has No Enforced Resource Budget Files, APIs and Safe Output Handling
Medium Detailed Errors Expose Sensitive Processing Context Files, APIs and Safe Output Handling
Critical Build Materials Contain a Long-Lived Service Secret Software Supply-Chain Assessment
High Known Vulnerable Dependency Handles Untrusted Documents Software Supply-Chain Assessment
Medium Container Scan Results Do Not Block Release Promotion Software Supply-Chain Assessment

Section 5

Relationship to the Azure Review

The Azure review assesses running configuration, service relationships and observable operational controls using safe, read-only evidence. The application review assesses source code, infrastructure as code, dependencies and delivery artifacts. Areas of overlap are intentionally compared. Agreement between the two evidence streams strengthens confidence, while differences reflect their distinct scopes and evidence boundaries.

Read the companion Azure architecture, deployment and operational security review.

Section 6

Public Edition and Disclosure

This purpose-built public edition is intended for external sharing. It contains no client names, tenant or subscription identifiers, resource names, internal URLs, work-item references, source paths, commit identifiers, screenshots, sample data, credentials, or combinations of details that could reconstruct a specific finding.

The severity-labelled material in Sections 4 through 9 consists only of newly authored fictional examples. It does not report, summarize or imply any engagement finding or actual severity rating.

Cross-reference links point only to newly authored demonstration evidence in Section 10. They are not client source links, Azure resource links or engagement tool output.

Section 7

Limitations

This report explains the assessment scope, methodology, control domains and generalized security lessons. It does not reproduce client-specific findings, severity ratings, evidence, remediation status or current production configuration. It is not a penetration-test report, certification, assurance opinion or statement that any example weakness was present. Inclusion of a topic means it was assessed, not that a finding existed. Severity labels apply only to the fictional examples and illustrate prioritization methodology.

Section 8

Public References