Foundations / 4 MIN READ

Start with a threat model

A threat model is a shared picture of how a system could be misused. Keep the first version small enough to update when the system changes.

1. Draw the request

   Draw the main components, data flows, and trust boundaries. Mark where sensitive data enters, moves, and is stored.

2. Ask what could go wrong

   Ask what an attacker could do at each boundary: impersonate a user, change data, expose secrets, or exhaust resources.

3. Make the control testable

   Choose controls for the most relevant risks. Assign owners and record assumptions that need testing.