threat-modeling

To generate a threat model from your codebase, you can run the threat-modeling workflow against your local target directory to automatically produce a formal THREAT_MODEL.md document. It reads your target code, design documents, and vulnerability history to classify validated threats.

STRIDE threat modeling is a structured risk-assessment technique used to identify and validate security threats in your code. This approach applies STRIDE to analyze your codebase, document findings, and output a formal THREAT_MODEL.md with recommended mitigations.

Yes, you can create a security threat model without manual input by using the bootstrap mode. This mode automatically seeds the threat model by directly analyzing your existing code and vulnerability history to produce the structured THREAT_MODEL.md output.

To document security threats and mitigations for a code audit, use the threat-modeling workflow to generate a THREAT_MODEL.md file. It conforms to a structured schema and includes sections for provenance, open questions, and recommended mitigations to support risk management.

The best way to integrate threat modeling into risk management workflows is by emitting a structured THREAT_MODEL.md file. This standardized output conforms to a fleet schema, enabling seamless integration with downstream triage tools and providing provenance for identified threats.