I'm to perform a security audit on the Drupal 8 Core modules, and was curious if there were any telltale signs of Entry Points (ie, how a module communicates with an external module and vice-versa).
OWASP defines an Entry Point as "the interfaces through which potential attackers can interact with the application or supply it with data."
I assume this is not very different from Entry Points of standard web applications (forms, HTTP packets, etc.), but I am interested in knowing whether or not Drupal has its own standard as to where these Entry Points are located. Are there specific snippets of code I should be looking for?
I do intend on reviewing the modules manually and in-depth, but figured someone on here may have some advice to help lessen the steep learning curve.
Any and all help is appreciated!