sec-threat-model

Security: threat modeling (STRIDE)

Find the risks in a design before they're code. Answer the four questions: What are we building? What can go wrong? What do we do about it? Did we do a good job?

Method

1. Model the system. Identify assets (data, credentials, money, availability), entry points / actors, trust boundaries (where privilege changes), and the data flows between components. Read the code/design to ground this — don't invent components.
2. Enumerate threats with STRIDE, per element / flow:
   • Spoofing (identity) — authentication gaps.
   • Tampering (integrity) — unvalidated input, mutable data in transit.
   • Repudiation — missing / forgeable audit logs.
   • Information disclosure — secrets, PII, error leaks.
   • Denial of service — unbounded work, no rate limits.
   • Elevation of privilege — broken authz, injection → RCE.
3. Rate each (likelihood × impact) and propose a mitigation (and which sec-* skill confirms it in code).
4. Residual risk — what remains after mitigation, and what's accepted.

Output

A threat table: element/flow · STRIDE category · threat · likelihood/impact · mitigation · owner skill, then the top risks and a short "did we cover it" note. Drives the focused sec-* reviews and wf-security-audit.