threat-modeling

Skill: Threat Modeling

Expertise: STRIDE framework, IDOR prevention, authorization boundary analysis, threat matrices for API and system security reviews.

When to load

When designing a new system, adding an integration, reviewing an architecture, or preparing for a security review.

STRIDE Framework

Threat Modeling Workflow

1. Identify assets — list sensitive data, APIs, and trust boundaries in the system
2. Apply STRIDE — walk through each threat category against every asset and boundary
3. Score risks — rank by likelihood × impact (Critical / High / Medium / Low)
4. Prioritize mitigations — address Critical/High first; document accepted risks for Medium/Low
5. Validate — verify mitigations with code review, SAST/DAST scans, or penetration testing

IDOR — Most Common API Vulnerability

# ❌ Vulnerable
@app.get("/invoices/{invoice_id}")
def get_invoice(invoice_id: int, current_user: User = Depends(get_current_user)):
    return db.query(Invoice).filter(Invoice.id == invoice_id).first()

# ✅ Safe: always scope to authenticated user
@app.get("/invoices/{invoice_id}")
def get_invoice(invoice_id: int, current_user: User = Depends(get_current_user)):
    invoice = db.query(Invoice).filter(
        Invoice.id == invoice_id,
        Invoice.owner_id == current_user.id  # ← ownership check
    ).first()
    if not invoice:
        raise HTTPException(status_code=404)  # 404, not 403
    return invoice