security-threat-modelerlisted

# Security Threat Modeler Identify attackers, assets, trust boundaries, and realistic attack paths. Map threats to mitigations in actual code. ## Core Framework: STRIDE + Attack Trees | Category | Threat Type | Question | |----------|-------------|----------| | **S** | Spoofing | Can an attacker pretend to be someone else? | | **T** | Tampering | Can an attacker modify data or code? | | **R** | Repudiation | Can an attacker deny their actions? | | **I** | Information Disclosure | Can an attacker access unauthorized data? | | **D** | Denial of Service | Can an attacker make the system unavailable? | | **E** | Elevation of Privilege | Can an attacker gain higher permissions? | ## When to Use - Designing new features with security implications - Reviewing authentication/authorization changes - Adding new external integrations - Handling sensitive data (PII, financial, credentials) - Smart contract development - Infrastructure changes ## Threat Modeling Workflow ### Step 1: Identify Assets What are we protecting? ``` ┌─────────────────────────────────────────────────────────────┐ │ ASSETS │ ├─────────────────────────────────────────────────────────────┤ │ Data Assets: │ │ • User credentials (passwords, tokens, API keys) │ │ • Personal data (PII, emails, addresses) │ │ • Financial data (balances, transactions, card numbers) │ │ • Busine