Security Threat Model

Overview

Deliver an actionable AppSec-grade threat model specific to a repository or project path, anchoring every architectural claim to evidence in the codebase with explicit assumptions.

Core principle: Every component, data store, endpoint, and flow must be derived from actual codebase analysis — not generic assumptions.

Eight-Step Workflow

Step 1: Scope and Extract

Identify from the repository:

• Components and services
• Data stores and their sensitivity
• External integrations and dependencies
• Runtime entrypoints (network listeners, APIs, CLI, webhooks)
• Explicit out-of-scope items (document these)