module-threat-modellisted

# Module: The Threat Model, by Sink **Loaded by:** `security-architect` · `code-review-architect` · `testing-architect` · `planning-architect` · `implementing-architect` · `brainstorming-planner`. Read the section your run needs; do not restate its content in a skill file. **The failure this exists to prevent:** security arriving as a review comment. By then the shape is already wrong — the ownership check has no natural place to live because the data access was designed without one, and the fix is a refactor nobody scheduled. Every category below is cheapest at plan time, affordable at write time, and expensive at review time. --- ## Read One Section, Not the File §1 above is the shared vocabulary and is short on purpose. Everything else is a reference file — read the one this run needs. | Read | When | |---|---| | `${CLAUDE_SKILL_DIR}/references/trust-boundaries.md` | **Plan time.** Where untrusted data enters, where privilege changes, where data leaves, and the control at each crossing. Produces a plan's Trust Boundaries table. | | `${CLAUDE_SKILL_DIR}/references/secure-construction.md` | **Write time.** The correct shape by sink — query, document, authorization, file, secret, error path, dependency. | | `${CLAUDE_SKILL_DIR}/references/review-sweep.md` | **Review time.** The yes/no/n-a sweep over a diff, grouped by OWASP anchor. | | `${CLAUDE_SKILL_DIR}/references/triage.md` | An advisory or scanner finding arrived. Reachability, blast radius, one outcome. | | `${CLA