// Phase 7.5 Code Validation guide. Use when validating threats against actual code, checking which security controls are implemented, or generating remediation reports.
Phase 1 Business Context Analysis guide. Use when starting a threat model, setting business context, or configuring business features like industry sector, data sensitivity, and regulatory requirements.
Phase 2 Architecture Analysis guide. Use when documenting system components, connections, data stores, or analyzing technical architecture for threat modeling.
Phase 3 Threat Actor Analysis guide. Use when identifying threat actors, setting relevance and priority, or analyzing who might attack the system.
Phase 4 Trust Boundary Analysis guide. Use when defining trust zones, crossing points, and security boundaries between system components.
Phase 5 Asset Flow Analysis guide. Use when identifying valuable assets, tracking data flows, or analyzing how sensitive data moves through the system.
Phase 6 Threat Identification guide with STRIDE methodology reference. Use when identifying threats, categorizing security issues, applying STRIDE analysis, or assessing threat severity and likelihood.
| name | phase-7-5-code-validation |
| description | Phase 7.5 Code Validation guide. Use when validating threats against actual code, checking which security controls are implemented, or generating remediation reports. |
Validate which security controls are already implemented in the codebase and update the threat model to reflect actual implementation state. This phase only runs when code is detected in the project.
Scans the codebase for implemented security controls.
directory: Path to scan (default: ".")file_patterns: Optional list of file patterns (e.g., [".py", ".js"])Checks which identified threats are already mitigated by code.
Creates a comprehensive report including:
update_threat(id, status=...) -- Update threat status based on findingsupdate_mitigation(id, status=...) -- Update mitigation statusadd_assumption(description, category, impact, rationale) -- Document code-based assumptions| Status | When to Use |
|---|---|
| threatIdentified | Still needs attention (default) |
| threatResolved | Code fully mitigates this threat |
| threatResolvedNotUseful | Threat not applicable given implementation |
| Status | When to Use |
|---|---|
| mitigationIdentified | Not yet implemented |
| mitigationInProgress | Partially implemented in code |
| mitigationResolved | Fully implemented in code |
| mitigationResolvedWillNotAction | Decided not to implement |
| Security Control | Code Patterns |
|---|---|
| Input validation | Schema validation, sanitization, regex checks |
| Authentication | Auth middleware, JWT verification, session checks |
| Authorization | RBAC checks, permission decorators, policy enforcement |
| Encryption | TLS config, KMS usage, encryption libraries |
| Logging | Logger calls, audit trail writes, CloudWatch/CloudTrail |
| Error handling | Try/catch, error sanitization, custom error pages |
| Rate limiting | Throttle middleware, API quota configs |
| CSRF protection | CSRF tokens, SameSite cookies |
get_phase_7_5_guidance()validate_security_controls() on the project directoryvalidate_threat_remediation() to match threats against codegenerate_remediation_report() for comprehensive analysisupdate_threat()update_mitigation()validate_security_controls() executedvalidate_threat_remediation() executedgenerate_remediation_report() generatedadvance_phase() to proceed to Phase 8