threat-modeling

name	threat-modeling
description	Perform STRIDE threat modeling for each component and trust boundary and produce a threat register. Use when reviewing a feature for security.

SKILL: Threat Modeling (STRIDE)

Output Location

docs/specs/{feature-slug}/threat-model.md

STRIDE Framework

For each component and trust boundary, evaluate all 6 threat categories:

Letter	Threat	Question
S	Spoofing	Can an attacker impersonate a user, service, or system?
T	Tampering	Can data be modified in transit or at rest without detection?
R	Repudiation	Can a user deny performing an action?
I	Information Disclosure	Can sensitive data leak to unauthorized parties?
D	Denial of Service	Can an attacker prevent legitimate users from accessing the service?
E	Elevation of Privilege	Can an attacker gain capabilities beyond what is authorized?

Threat Model Template

# Threat Model: {Feature Name}

## Assets
| Asset | Sensitivity | Owner |
|-------|-------------|-------|
| User PII | High | {team} |
| Payment data | Critical | {team} |
| API keys | Critical | {team} |

## Trust Boundaries
- Internet <-> Load Balancer
- Load Balancer <-> Application
- Application <-> Database
- Application <-> Third-party APIs

## STRIDE Analysis

### {Component Name}

**S — Spoofing**
- Risk: {description}
- Likelihood: High/Medium/Low
- Impact: High/Medium/Low
- Mitigation: {control}

**T — Tampering**
...

**R — Repudiation**
...

**I — Information Disclosure**
...

**D — Denial of Service**
...

**E — Elevation of Privilege**
...

## Risk Register
| Threat | Component | Likelihood | Impact | Risk Level | Mitigation | Status |
|--------|-----------|------------|--------|------------|------------|--------|
| SQL Injection | API | High | Critical | Critical | Parameterized queries | Mitigated |

## Mitigations Required Before Launch
- [ ] {Critical mitigation 1}
- [ ] {Critical mitigation 2}

Common Mitigations

• Authentication: JWT with short expiry, refresh token rotation.
• Authorization: RBAC, RLS on database.
• Input validation: Zod/FluentValidation on all inputs.
• Rate limiting: Per-IP and per-user limits.
• Encryption: TLS 1.3 in transit, AES-256 at rest.
• Audit logging: All write operations logged with actor + timestamp.
• Secrets management: Never in code; use environment variables or vault.