| name | threat-modeling |
| description | Perform STRIDE threat modeling for each component and trust boundary and produce a threat register. Use when reviewing a feature for security. |
SKILL: Threat Modeling (STRIDE)
Output Location
docs/specs/{feature-slug}/threat-model.md
STRIDE Framework
For each component and trust boundary, evaluate all 6 threat categories:
| Letter | Threat | Question |
|---|
| S | Spoofing | Can an attacker impersonate a user, service, or system? |
| T | Tampering | Can data be modified in transit or at rest without detection? |
| R | Repudiation | Can a user deny performing an action? |
| I | Information Disclosure | Can sensitive data leak to unauthorized parties? |
| D | Denial of Service | Can an attacker prevent legitimate users from accessing the service? |
| E | Elevation of Privilege | Can an attacker gain capabilities beyond what is authorized? |
Threat Model Template
# Threat Model: {Feature Name}
## Assets
| Asset | Sensitivity | Owner |
|-------|-------------|-------|
| User PII | High | {team} |
| Payment data | Critical | {team} |
| API keys | Critical | {team} |
## Trust Boundaries
- Internet <-> Load Balancer
- Load Balancer <-> Application
- Application <-> Database
- Application <-> Third-party APIs
## STRIDE Analysis
### {Component Name}
**S — Spoofing**
- Risk: {description}
- Likelihood: High/Medium/Low
- Impact: High/Medium/Low
- Mitigation: {control}
**T — Tampering**
...
**R — Repudiation**
...
**I — Information Disclosure**
...
**D — Denial of Service**
...
**E — Elevation of Privilege**
...
## Risk Register
| Threat | Component | Likelihood | Impact | Risk Level | Mitigation | Status |
|--------|-----------|------------|--------|------------|------------|--------|
| SQL Injection | API | High | Critical | Critical | Parameterized queries | Mitigated |
## Mitigations Required Before Launch
- [ ] {Critical mitigation 1}
- [ ] {Critical mitigation 2}
Common Mitigations
- Authentication: JWT with short expiry, refresh token rotation.
- Authorization: RBAC, RLS on database.
- Input validation: Zod/FluentValidation on all inputs.
- Rate limiting: Per-IP and per-user limits.
- Encryption: TLS 1.3 in transit, AES-256 at rest.
- Audit logging: All write operations logged with actor + timestamp.
- Secrets management: Never in code; use environment variables or vault.
