Threat Model (Lite)

When to use

Use this skill when planning a feature, reviewing an architecture, or preparing security requirements.

Inputs to collect (if available)

• •Entry points (endpoints/jobs)
• •Assets and sensitivities (PII, secrets, money movement)
• •External services and trust assumptions
• •Deployment details (internet-facing, multi-tenant, auth model)

Step-by-step process

1. •Define scope
   • •What is being built/changed? What is explicitly out of scope?
2. •Describe the system
   • •Components, identities, data stores, external dependencies
3. •Identify assets
   • •Secrets, PII, money-moving actions, admin capabilities, integrity-critical data
4. •Map trust boundaries
   • •Internet ↔ edge, edge ↔ app, app ↔ data, service ↔ service
5. •List top threats (ranked)
   • •Use STRIDE reasoning; focus on realistic threats
6. •Mitigations
   • •Prevent: validation, authz, rate limiting, encryption
   • •Detect: logs, alerts, anomaly detection
   • •Respond: rollback, key rotation, incident playbooks
7. •Residual risk
   • •What remains and why; follow-ups

Output template

• •System overview
• •Data flows (bulleted)
• •Assets
• •Trust boundaries
• •Top threats + mitigations
• •Residual risk + next steps

Output format

• •Scope
• •Assets & trust boundaries
• •Top threats (ranked) with mitigations (prevent/detect/respond)
• •Validation scenarios (3)

Examples

• •“New webhook endpoint” → threats: spoofing, replay, SSRF; mitigations: signature validation, nonce/timestamp, allow-listed egress.