A trust boundary is any point where data crosses from a less-trusted context into a more-trusted one: user input into a query, a request into a privileged process, one tenant’s data into another’s view. Almost every vulnerability class is a failure to re-establish trust at such a crossing.
Why it holds
Injection is untrusted input crossing into an interpreter without being made safe for it: SQL injection into a database, command injection into a shell, template injection into a template engine, cross-site scripting into another user’s browser. Authorisation bugs are a principal crossing into data it should not reach. Even privilege escalation, whether through a SUID binary or a potato attack, is a low-trust process crossing into a high-trust one. Naming the boundary tells you what defence is missing: encode for the destination context, or check the right to cross.
Where it breaks
Some bugs are not boundary crossings. A logic error, a race, or a weak algorithm choice can sit wholly inside one trust context. The lens is a strong default for finding injection and authorisation flaws, not a complete taxonomy.