security-review

You can automate STRIDE threat modeling for pull requests by running structured security reviews that analyze code changes. The review checks for a threat model file and auto-generates one if missing, then outputs validated findings for remediation.

STRIDE-based security review is a structured threat modeling approach that categorizes potential vulnerabilities in code changes. It systematically analyzes code across PRs, scheduled scans, or full audits to produce standardized findings for remediation planning.

You do not need an existing threat model file to run a security review. If the .factory/threat-model.md file is missing, the security review process will automatically generate or update it before applying STRIDE threat modeling.

You can run a full repository security audit using the full mode. This performs a comprehensive STRIDE-based threat modeling scan across your entire codebase, generating structured findings suitable for reporting and remediation.

The best way to integrate structured vulnerability findings is by scheduling weekly scans or automating PR reviews. This applies STRIDE threat modeling continuously, outputting standardized findings that align with actionable remediation recommendations.

When auto-generating a threat model for security reviews, the limitation is that the auto-generated .factory/threat-model.md file serves as a baseline. You should review and refine it to ensure the STRIDE analysis accurately reflects your specific application architecture and threat landscape.