Attack surface
Also called Hardening
Every place someone outside can send your system something: forms, URLs, uploads, webhooks, headers, and any file or page your agent reads. The bigger it is, the more you have to defend.
Agents grow it quietly. A debug route left in, a new webhook, a dependency, an MCP server: each one works, each one passes its tests, and each one is another door. It rarely shows up as the point of the change, so read the diff for it.
Say it to your agent
“List every new way in that this branch adds: routes, webhooks, file uploads, environment variables read, dependencies. For each, say who can reach it and what checks it. Remove the debug route.”