security-threat-modeling
Installation
SKILL.md
Security Threat Modeling
Identify assets, actors, trust boundaries, what can go wrong, controls, and tests before implementation or review.
Process
- Inspect the changed behavior and data flow before listing risks.
- Check negative paths, bypasses, tenant/object boundaries, logs, cache, async jobs, and release impact where relevant.
- For review, report findings by severity with file references and concrete exploit or failure scenarios.
- For implementation, add controls and tests in the backend or trusted boundary; do not rely on frontend-only enforcement.
Evidence
Prefer code, tests, logs, config, API contracts, and data examples over assumptions.
Focused References
- 01-overview.md - Overview; Cel dokumentu; Standardy odniesienia; Zasady pracy
- 02-security-review-pull-requestu.md - Security review pull requestu; Integracja z innymi dokumentami zespołu; Role i odpowiedzialności; Checklist code review