Repository Threat Model
By Kai · Published · Updated
Builds a threat model of a repository: its assets, trust boundaries, attacker capabilities, and abuse paths, each tied to the code that enables it.
Prompt template
## Repository Threat Model Threat model this repository. - Repository and purpose: [textarea: What it does and who runs it] - Deployment shape: [dropdown: Web service, Library, CLI tool, Mobile app, Serverless, Batch job] - Key entry points: [textarea: Endpoints and queues and files read] - Most valuable assets: [multi: User data, Credentials, Money movement, Source code, Availability, Reputation] - Attacker types to consider: [multi: Anonymous internet user, Authenticated user, Malicious insider, Compromised dependency] - Scope of code to read: [text: Folders or services] Read the code before theorising. List the assets and where each is stored or processed. Draw the trust boundaries in words: where data crosses from less trusted to more trusted. For each attacker type, state what they can already do and what they must not be able to do. Then write abuse paths: a numbered chain of steps from attacker capability to harm, and cite the file and function at each step. Rate each path by likelihood and impact, with a one-line reason. For every path propose the cheapest control that breaks the chain, naming where it goes. Mark anything you inferred but could not confirm in code. End with the five paths to fix first.