threat-model:tnf

To analyze a TNF pull request for security threats using STRIDE, run the threat-model command with the PR number. It extracts diffs, maps changed code paths to TNF DFD elements, applies STRIDE reasoning, and generates a structured report.

MITRE ATT&CK and OWASP mappings are generated by cross-referencing identified security threats from the PR diff against formal standards. The analysis links each finding to specific MITRE techniques and OWASP 2025 categories for consistent reporting.

Yes, you can map changed code paths to TNF data flow diagram elements. The threat analysis extracts PR diffs and metadata to cross-reference the formal TNF threat model, identifying affected processes, data stores, and flows.

Yes, the TNF threat model analysis optionally runs ShellCheck on pull request changes. It executes workspace discovery, extracts PR diffs, and runs ShellCheck to identify potential security vulnerabilities in modified shell scripts.

The best way to track cumulative TNF security findings is by appending analysis results into a cumulative TNF findings file. This evidence accumulation approach maintains a historical record for repeatable review and follow-up triage over time.

You need a formal TNF threat model for pull request security reviews when you want to replace ad-hoc reasoning with structured, standards-based threat analysis. It ensures consistent identification of security risks introduced by code changes in the TNF topology.