Attack surface
Every door, window, and vent into your system: routes, forms, uploads, ports, dependencies, admin panels. Count them, then delete what you can.
See it
What it is
The sum of every point where an untrusted party can send you input or reach your systems. It is bigger than people expect: public API routes and form fields, file uploads, webhook receivers, query parameters, auth flows, admin panels, open ports, DNS records, object storage buckets, preview and staging deploys, third-party scripts on the page, every npm dependency, the CI pipeline, and the humans with production access.
It is useful because it turns security into an inventory problem you can actually finish. List the surface, mark what requires authentication, and then shrink: delete the unused endpoint, close the port, drop the analytics script, remove the debug route, take the staging environment off the public internet. Hardening is mostly subtraction, and deleted surface needs no patching, no monitoring, and no WAF rule. Ask 'what surface does this add?' when reviewing a feature.
Gotcha: the piece that gets you is the piece you forgot you owned. A staging box with a copy of production data, an old preview URL still serving, a dangling DNS record pointing at a deprovisioned host (subdomain takeover), a '/debug' route left behind, or an internal service that is 'not public' but happens to answer from the internet. Surface grows on its own; shrinking it is deliberate work.
Ask AI for it
Map the attack surface of this codebase and infrastructure config. Produce a table with one row per exposed point covering: every HTTP route and its auth requirement, every form input and file upload, every webhook receiver and its signature check, every public object storage bucket, every open port and exposed service in the Docker or deploy config, every third-party script loaded in the browser, every environment variable or secret consumed, and every admin or debug endpoint. Columns: surface, where it lives in the repo, who can reach it, what authentication or validation guards it, and worst realistic outcome if abused. Then give me a ranked shrink list of things that can simply be deleted or put behind auth.