Attack-path-aware secure code review for AI-assisted security work.
Releases · Roadmap · Contributing · Security · Citation
ExploitLattice is a reusable security-review Skill and deterministic attack-path helper for source code, pull-request diffs, APIs, configuration, Infrastructure-as-Code, dependencies, authentication/authorization logic, secrets, and cloud-facing controls.
Instead of stopping at a flat list of vulnerabilities, it asks a more useful question:
Which weaknesses can actually connect into a credible attacker path, and which fix breaks the most dangerous path first?
| Capability | What it adds |
|---|---|
| Evidence Gate | Separates Confirmed, Probable, Needs Validation, and dismissed findings so suspicion is not presented as fact. |
| Attack-Path Chaining | Connects findings only when one creates a capability required by another. |
| Reachability-Aware Prioritization | Ranks risk using impact, reachability, evidence, asset criticality, privilege crossing, and path membership. |
| Patch + Proof | Pairs remediation with a proposed secure patch and tests that demonstrate the control works. |
| Remediation Choke Points | Highlights fixes that break multiple credible attack paths, not just the highest standalone severity. |
A leaked service credential may be High severity. A tenant-authorization flaw may also be High severity. Reviewed separately, they become two tickets.
Reviewed together, they may form a direct path:
Public source exposure
-> EL-001: usable service credential
-> valid_service_credential
-> EL-002: missing tenant authorization
-> cross-tenant record access
ExploitLattice is designed to surface that relationship, distinguish evidence from assumption, and identify the remediation that reduces the most real-world risk.
- Repository review — architecture, trust boundaries, code, configuration, dependencies, IaC, and CI/CD.
- PR/diff review — changed code plus the security-sensitive context around it.
- Focused review — a file, snippet, endpoint, module, configuration, or individual control.
ExploitLattice can review or reason about:
- authentication, session, and token handling;
- horizontal and vertical authorization;
- tenant isolation;
- injection and unsafe parsing;
- secrets and sensitive-data exposure;
- cryptography and key handling;
- SSRF, path traversal, file handling, and unsafe redirects;
- deserialization, dynamic execution, shell/process use, and template injection;
- dependency, build, CI/CD, and software-supply-chain risk;
- cloud, IAM, container, network, and Infrastructure-as-Code configuration;
- security logging and defensive validation.
ExploitLattice supports defensible mappings to:
- OWASP Top 10:2025
- OWASP ASVS 5.0.0
- CWE
- CVSS v4.0 when enough metrics are known
It deliberately avoids claiming complete OWASP coverage from static review alone.
No external Python dependencies are required for the deterministic helper.
python scripts/validate_findings.py examples/demo-findings.json
python scripts/build_attack_paths.py examples/demo-findings.json --output attack-paths.json
python -m unittest discover -s tests -vThe helper does not scan or exploit systems. It operates only on structured findings already supplied to it.
Review this repository with ExploitLattice. Prioritize exploitable attack paths and give me merge-blocking fixes first.
Review this PR for authentication, authorization, secrets, injection, dependency, and cloud/IaC regressions. Separate confirmed findings from issues that still need validation.
Analyze these findings as an attack graph. Show which weakness is the best remediation choke point and provide validation tests for each fix.
Every candidate finding receives one evidence state:
- Confirmed — directly supported by code, configuration, dependency, or authorized validation evidence.
- Probable — strong evidence exists, but an important runtime/configuration fact remains unknown.
- Needs Validation — a credible pattern exists but there is not enough evidence to claim a vulnerability.
- Not a Finding — mitigated, unreachable, incorrect, or unsupported.
Severity and confidence are intentionally kept separate.
exploit-lattice/
├── SKILL.md
├── agents/
│ └── openai.yaml
├── assets/
│ └── exploitlattice-workflow.svg
├── references/
│ ├── attack-path-model.md
│ ├── output-format.md
│ ├── review-playbook.md
│ ├── secure-review-checklist.md
│ └── standards.md
├── scripts/
│ ├── build_attack_paths.py
│ └── validate_findings.py
├── examples/
│ ├── demo-findings.json
│ ├── demo-attack-paths.json
│ └── sample-report.md
├── tests/
│ └── test_build_attack_paths.py
├── .github/
│ ├── ISSUE_TEMPLATE/
│ └── workflows/test.yml
├── CITATION.cff
├── ROADMAP.md
├── CONTRIBUTING.md
├── SECURITY.md
└── LICENSE
- Evidence over alert volume
- Root cause over duplicate symptoms
- Reachability over theoretical severity
- Attack paths over disconnected findings
- Remediation leverage over ticket count
- Secure fixes with regression checks
- Clear limits when runtime or repository context is missing
Candidate next steps include machine-readable security output, deterministic attack-path visualization from structured findings, PR summary rendering, calibration/false-positive evaluation, and extensible defensive review profiles. See ROADMAP.md.
ExploitLattice is intended for defensive review of code and systems the reviewer owns or is explicitly authorized to assess. Active security testing should only occur with defined permission and scope. The project is not designed for destructive exploitation, persistence, credential theft, data exfiltration, or service disruption.
v1.0.0 — Initial Public Release
The initial release includes the Evidence Gate, attack-path chaining, deterministic prioritization, standards-mapping guidance, synthetic demonstrations, unit tests, and GitHub Actions validation.
- OWASP Top 10:2025: https://owasp.org/Top10/2025/
- OWASP ASVS: https://owasp.org/www-project-application-security-verification-standard/
- CWE Top 25: https://cwe.mitre.org/top25/
- CVSS v4.0: https://www.first.org/cvss/v4.0/specification-document
MIT License. See LICENSE.
Blessing Ezeobioha
Cybersecurity practitioner working across security operations, threat intelligence, compliance, secure systems, and responsible AI security.