---

name: security-threat-modeler description: Identify attackers, assets, trust boundaries, and realistic attack paths. Use when analyzing security posture, reviewing new features for threats, or creating threat models. Triggers on "threat model", "attack surface", "security analysis", "trust boundaries", "attacker goals", "threat assessment", "security review", "attack vectors".

Security Threat Modeler

Identify attackers, assets, trust boundaries, and realistic attack paths. Map threats to mitigations in actual code.

Core Framework: STRIDE + Attack Trees

When to Use

• Designing new features with security implications
• Reviewing authentication/authorization changes
• Adding new external integrations
• Handling sensitive data (PII, financial, credentials)
• Smart contract development
• Infrastructure changes

Threat Modeling Workflow

Step 1: Identify Assets

What are we protecting?

Copy┌─────────────────────────────────────────────────────────────┐
│                        ASSETS                                │
├─────────────────────────────────────────────────────────────┤
│ Data Assets:                                                 │
│   • User credentials (passwords, tokens, API keys)          │
│   • Personal data (PII, emails, addresses)                  │
│   • Financial data (balances, transactions, card numbers)   │
│   • Business data (trades, orders, contracts)               │
│                                                             │
│ System Assets:                                              │
│   • Infrastructure (servers, databases, keys)               │
│   • Code/IP (source code, algorithms)                       │
│   • Availability (uptime, service access)                   │
│                                                             │
│ Reputation Assets:                                          │
│   • Trust (user confidence, regulatory standing)            │
│   • Brand (public perception)                               │
└─────────────────────────────────────────────────────────────┘

Step 2: Map Trust Boundaries

Where does trust change?

Copy┌─────────────────────────────────────────────────────────────┐
│  UNTRUSTED                                                   │
│  ┌─────────────┐                                            │
│  │   Internet  │                                            │
│  └──────┬──────┘                                            │
│         │                                                    │
│ ════════╪═══════════════════════════════════════════════════│
│         │  BOUNDARY: Public Internet → API Gateway          │
│ ════════╪═══════════════════════════════════════════════════│
│         ▼                                                    │
│  ┌─────────────┐                                            │
│  │ API Gateway │  (Auth, Rate Limiting)                     │
│  └──────┬──────┘                                            │
│         │                                                    │
│ ════════╪═══════════════════════════════════════════════════│
│         │  BOUNDARY: Gateway → Internal Services            │
│ ════════╪═══════════════════════════════════════════════════│
│         ▼                                                    │
│  ┌─────────────┐      ┌─────────────┐                       │
│  │  Service A  │◄────►│  Service B  │                       │
│  └──────┬──────┘      └─────────────┘                       │
│         │                                                    │
│ ════════╪═══════════════════════════════════════════════════│
│         │  BOUNDARY: Services → Data Stores                 │
│ ════════╪═══════════════════════════════════════════════════│
│         ▼                                                    │
│  ┌─────────────┐                                            │
│  │  Database   │                                            │
│  └─────────────┘                                            │
│  TRUSTED                                                     │
└─────────────────────────────────────────────────────────────┘

Step 3: Profile Attackers

Who might attack and why?

Step 4: Map Attack Surfaces

Copy# Find external endpoints
grep -rn "@Get\|@Post\|router\." --include="*.ts" --include="*.go"

# Find authentication points
grep -rn "login\|authenticate\|verify.*token" --include="*.ts"

# Find file upload handlers
grep -rn "upload\|multipart\|file" --include="*.ts"

# Find external API calls
grep -rn "fetch\|axios\|http\." --include="*.ts"

# Find admin/privileged functions
grep -rn "admin\|sudo\|privilege\|role" --include="*.ts"

Step 5: Build Attack Trees

For each high-value asset, create an attack tree:

Copy                    ┌──────────────────┐
                    │ GOAL: Steal Funds │
                    └────────┬─────────┘
                             │
         ┌───────────────────┼───────────────────┐
         │                   │                   │
         ▼                   ▼                   ▼
   ┌───────────┐      ┌───────────┐      ┌───────────┐
   │ Compromise│      │  Exploit  │      │  Social   │
   │   Auth    │      │   Logic   │      │ Engineer  │
   └─────┬─────┘      └─────┬─────┘      └─────┬─────┘
         │                  │                  │
    ┌────┴────┐        ┌────┴────┐        ┌────┴────┐
    │         │        │         │        │         │
    ▼         ▼        ▼         ▼        ▼         ▼
 ┌─────┐ ┌─────┐  ┌─────┐ ┌─────┐  ┌─────┐ ┌─────┐
 │Brute│ │Steal│  │Race │ │Price│  │Phish│ │Bribe│
 │Force│ │Token│  │Cond.│ │Manip│  │User │ │Staff│
 └─────┘ └─────┘  └─────┘ └─────┘  └─────┘ └─────┘

See CHECKLIST.md for complete threat checklist. See ATTACK-LIBRARY.md for common attack patterns.

Output Format

A) Assets at Risk

Copy┌─────────────────────────────────────────────────────────────┐
│                      ASSETS AT RISK                          │
├───────────────┬──────────────┬───────────────────────────────┤
│ Asset         │ Value        │ Impact if Compromised         │
├───────────────┼──────────────┼───────────────────────────────┤
│ User tokens   │ CRITICAL     │ Account takeover, fund theft  │
│ Trading keys  │ CRITICAL     │ Unauthorized trades           │
│ User PII      │ HIGH         │ Regulatory fines, lawsuits    │
│ Order history │ MEDIUM       │ Privacy violation             │
└───────────────┴──────────────┴───────────────────────────────┘

B) Attack Surfaces

Copy┌─────────────────────────────────────────────────────────────┐
│                     ATTACK SURFACES                          │
├───────────────┬──────────────┬───────────────────────────────┤
│ Surface       │ Exposure     │ Entry Points                  │
├───────────────┼──────────────┼───────────────────────────────┤
│ REST API      │ Public       │ /api/*, 15 endpoints          │
│ WebSocket     │ Public       │ /ws/*, price feeds            │
│ Admin Panel   │ Internal     │ /admin/*, 8 endpoints         │
│ Worker Queue  │ Internal     │ RabbitMQ, 3 consumers         │
│ Database      │ Internal     │ PostgreSQL, port 5432         │
└───────────────┴──────────────┴───────────────────────────────┘

C) Threat Scenarios

For each significant threat:

Copy### THREAT: [Name]

**ID:** THREAT-001
**Category:** [STRIDE category]
**Attacker:** [Who would attempt this]
**Goal:** [What they want to achieve]

**Attack Path:**
1. [Step 1]
2. [Step 2]
3. [Step 3]

**Preconditions:**
- [What must be true for attack to work]

**Likelihood:** [Low/Medium/High]
**Impact:** [Low/Medium/High/Critical]
**Risk Score:** [Likelihood × Impact]

**Affected Code:**
- `path/to/vulnerable/code.ts:123`

**Current Mitigations:**
- [Existing defense, if any]

**Recommended Mitigations:**
- [What should be added]

D) Mitigations Mapped to Code

Copy┌─────────────────────────────────────────────────────────────┐
│               MITIGATIONS → CODE MAPPING                     │
├─────────────────────┬───────────────────────────────────────┤
│ Mitigation          │ Implementation Location               │
├─────────────────────┼───────────────────────────────────────┤
│ Rate limiting       │ src/middleware/rateLimit.ts:45       │
│ Input validation    │ src/validators/orderSchema.ts:12     │
│ Auth middleware     │ src/middleware/auth.ts:78            │
│ MISSING: CSRF       │ ❌ Not implemented                    │
│ MISSING: WAF rules  │ ❌ Not implemented                    │
└─────────────────────┴───────────────────────────────────────┘

E) Risk Matrix

Copy                         IMPACT
              Low      Medium     High      Critical
         ┌─────────┬─────────┬─────────┬─────────┐
   High  │ MEDIUM  │  HIGH   │ CRITICAL│ CRITICAL│
         ├─────────┼─────────┼─────────┼─────────┤
L Medium │   LOW   │ MEDIUM  │  HIGH   │ CRITICAL│
I        ├─────────┼─────────┼─────────┼─────────┤
K  Low   │   LOW   │   LOW   │ MEDIUM  │  HIGH   │
E        └─────────┴─────────┴─────────┴─────────┘
L
I   Threats by risk:
H   • THREAT-003: Token theft [CRITICAL]
O   • THREAT-001: SQL injection [HIGH]
O   • THREAT-007: Rate limit bypass [MEDIUM]
D   • THREAT-012: Info disclosure [LOW]

F) Prioritized Recommendations

CopyIMMEDIATE (This Sprint):
1. [Highest risk mitigation] - blocks THREAT-001, THREAT-003

SHORT-TERM (Next 30 days):
2. [Medium risk mitigation] - blocks THREAT-007
3. [Medium risk mitigation]

LONG-TERM (Roadmap):
4. [Defense in depth improvement]
5. [Monitoring enhancement]

Quick Commands

Copy# Find authentication code
grep -rn "authenticate\|authorize\|checkPermission" --include="*.ts"

# Find cryptographic operations
grep -rn "crypto\|encrypt\|decrypt\|hash\|sign\|verify" --include="*.ts"

# Find SQL queries
grep -rn "SELECT\|INSERT\|UPDATE\|DELETE\|query(" --include="*.ts"

# Find user input handling
grep -rn "req\.body\|req\.params\|req\.query" --include="*.ts"

# Find secret handling
grep -rn "secret\|password\|apiKey\|token" --include="*.ts" --include="*.env*"

# Find privileged operations
grep -rn "admin\|root\|sudo\|elevate" --include="*.ts"

Resources

• CHECKLIST.md - Complete threat checklist
• ATTACK-LIBRARY.md - Common attack patterns & mitigations