Threat Modeling Process

A gate-driven workflow for producing a small, focused threat model of the current work — a planned feature, a module, an API, or the changes on the current branch — using a lightweight STRIDE pass over the system's data flows and trust boundaries. The goal is a practical, traceable model that drives mitigations, not an exhaustive enterprise artifact. The output lives in docs/security/threat-models/{slug}/THREAT-MODEL.md.

Two invocation modes:

• Standalone (threat-model a component or change): own branch assess/threat-{slug} → PR to develop.
• Embedded in another flow: write into the caller's current branch/worktree; the model ships with that flow's PR. No separate branch or PR. Examples: incu-way-development running a threat model right after the PLAN at Gate 2 (so mitigations become plan tasks); incu-way-bugs modeling a security-relevant fix.