threat-triggers

/threat-triggers — Configure What Auto-Requires Threat Models

Tune the list of "sensitive" patterns that warn when uncovered.

When to use

• First time using threat-model-lite — review default triggers
• Project has unusual sensitive entities not in defaults (e.g., health_record, tax_id)
• Some default triggers don't apply (e.g., no payment in this project)
• Want to add custom file path patterns

Usage

/threat-triggers show              # Print current triggers
/threat-triggers add-pattern --category CAT --pattern "..."
/threat-triggers add-path "PATH-GLOB"
/threat-triggers exempt --path "..." --reason "..."
/threat-triggers init              # Re-initialize from default template

Default triggers

The bundled triggers.yaml covers:

Category	Patterns	Severity
authentication	auth*, login*, password, session, token, jwt, oauth, saml, sso, mfa, 2fa	high
payment	payment, billing, invoice, refund, charge, subscription, checkout, card, wallet	critical
pii	email, phone, ssn, name, address, kyc, identity, passport, birthdate	high
authorization	admin, role, permission, rbac, abac, scope, grant	high
secrets	secret, api_key, apikey, private_key, credential	critical

Plus path patterns:

• **/auth/**, **/payment/**, **/billing/**, **/admin/**, **/security/**

Plus endpoint patterns:

• POST /login, POST /signup, POST /password/*, */admin/*, POST /payment/*, POST /webhook/*

Instructions

Step 1 — Read current triggers

cat .harness/threat-model-lite/triggers.yaml

If the file doesn't exist (methodology just activated), copy from template:

cp .harness/methodologies/threat-model-lite/templates/triggers.yaml \
   .harness/threat-model-lite/triggers.yaml

Step 2 — Edit triggers.yaml directly

The triggers file is a hand-edit YAML. Add/remove categories, patterns, paths, endpoints. Schema:

sensitive_entities:
  <category-name>:
    patterns: ["pattern1", "pattern2*"]
    severity: low | medium | high | critical

sensitive_paths:
  - "**/glob/pattern/**"

sensitive_endpoints:
  - "POST /route"
  - "GET /route/*"

exemptions:
  paths: ["specific/path/that/is/safe"]
  reasons:
    "specific/path/that/is/safe": "documented reason"