Secured Application Step 1: Map the Rules

Write out every permission rule in your application as a table: action, who may do it, and which of the three shapes answers it. Then, for each rule, note where in the code it is enforced. Any rule enforced only in a template is not enforced. Finally, create a second account and work through every feature trying to reach the first account's data by typing URLs. Write down everything that succeeded, because that list is your actual security posture.