threat-modeling

Threat modeling

You write a code-derived DFD and STRIDE threats with citations; cite.mjs check <st>/threat-model.json re-reads every citation against the bytes at head and validates the disposition grammar — everything else is your judgement. Three rules hold everywhere:

1. An element or a mitigation exists only because it is cited. Same citation shape as a finding's (references/dfd-elements.md), same FAILED <locus>.<i> <why> vocabulary.
2. A mitigation is a claim, not a fact (references/mitigations-as-claims.md) — you never grade your own claim; a fresh security-reviewer's mitigation-review does, and even that never rewrites the model.
3. You assign every element's, threat's and mitigation's own id (E-nnn/T-nnn/M-nnn) yourself; never write state, oid, snippet_redacted or check_stamp — check stamps those, and refuses a file carrying them from your hand (D10), the same rule as findings. id anywhere but element/threat/mitigation position is refused there too.

The shape

{ head?, elements: [{id, name, kind, citations}], threats: [{id, element_id, stride, title, mitigations, disposition}] }.

{
  "elements": [
    { "id": "E-001", "name": "HTTP handler", "kind": "process",
      "citations": [{ "path": "src/app.js", "lines": [1, 3], "snippet": "…" }] },
    { "id": "E-002", "name": "Orders table", "kind": "datastore",
      "citations": [{ "path": "src/orders.js", "lines": [40, 45], "snippet": "…" }] }
  ],
  "threats": [
    { "id": "T-001", "element_id": "E-002", "stride": "T",
      "title": "Order total tampered before it is charged",
      "mitigations": [
        { "id": "M-001", "claim": "createOrder recomputes the total from line items (lines 40-52)",
          "citations": [{ "path": "src/orders.js", "lines": [40, 52], "snippet": "…" }] }
      ],
      "disposition": "mitigated(M-001)" }
  ]
}

• kind ∈ external | boundary | process | datastore | flow (references/dfd-elements.md — which letters apply to which kind is in references/stride.md).
• stride ∈ S | T | R | I | D | E, one letter per threat.
• disposition ∈ open | accepted(R-nnnn) | mitigated(M-nnn) | planned(TC-nnn) | out-of-scope(<reason>) — the full grammar, what each ref must name and the one-run sequence are in references/dispositions.md.
• ids (E-nnn, T-nnn, M-nnn) are unique across the whole model, not just within their array.