security-threat-model

## Purpose Produce a structured threat model that systematically identifies what can go wrong in a system from a security perspective, who would attack it, how they would do it, and what concrete controls prevent or mitigate each attack. **Security is not a feature to add at the end.** A threat model performed before implementation costs hours. A security breach found after launch costs millions and destroys trust that took years to build. ## Input **Works best with:** The name of the system, feature, or integration being threat-modeled. **Also valuable:** An existing architecture document, data flow diagram, API design, or description of how data moves through the system. **Example invocation:** `Threat model our new webhook delivery system. Merchants register endpoint URLs. Our system sends signed HTTP POST requests with event payloads. Merchants verify signatures using a per-merchant secret. The system retries failed deliveries up to 3 times with exponential backoff.` ## Key Concepts ### STRIDE Framework (Microsoft SDL) The six threat categories that cover all known attack classes: | Letter | Threat | Violates | Example | | :--- | :--- | :--- | :--- | | **S** | Spoofing | Authentication | Attacker impersonates a legitimate user or system | | **T** | Tampering | Integrity | Attacker modifies data in transit or at rest | | **R** | Repudiation | Non-repudiation | User denies performing an action with no audit trail to prove otherwise | | **I** | Information Disclosure...