PixelPilot threat-modeling.instructions.md

Threat Modelling 2026

STRIDE threat model → trust boundary diagram → threat table → mitigations → security test cases. Run before writing security-sensitive code.

---

THE STRIDE MODEL

Letter	Threat	Violates	Example
S	Spoofing	Authentication	Attacker impersonates admin user
T	Tampering	Integrity	Attacker modifies request payload
R	Repudiation	Non-repudiation	User denies making a purchase
I	Information disclosure	Confidentiality	API leaks other users' data
D	Denial of service	Availability	Flood endpoint to make it unreachable
E	Elevation of privilege	Authorization	Regular user accesses admin endpoint

---

STEP 1 — DECOMPOSE THE SYSTEM

Before applying STRIDE, map the system using Data Flow Diagrams (text format).

## System Decomposition

### Actors (external entities)
- **Anonymous user** — unauthenticated visitor
- **Authenticated user** — logged-in member
- **Admin** — internal staff with elevated access
- **Third-party service** — Stripe, OAuth provider, email service

### Processes
- **Auth service** — login, registration, session management
- **API gateway** — routes, rate limiting, auth middleware
- **Business logic** — core feature processing
- **Background workers** — async jobs (emails, reports)

### Data stores
- **Primary DB** — user records, transactions
- **Cache** — session tokens, temporary data
- **File storage** — user uploads (S3 / R2)
- **Audit log** — immutable event log

### Trust boundaries (draw these explicitly)
─────────────────────────────────────────
  [ Internet / untrusted zone ]
  ↓ HTTPS ↓
  [ Load balancer / WAF ]          ← Trust boundary 1
  ↓
  [ API gateway + rate limiter ]   ← Trust boundary 2
  ↓
  [ Application server ]
  ↓                    ↓
  [ Primary DB ]   [ External APIs ]  ← Trust boundary 3
─────────────────────────────────────────

---

STEP 2 — APPLY STRIDE TO EACH COMPONENT