145
threat model
Who attacks, what they want, what they already have. Controls come after that, not before.
What is threat model?
A threat model names assets, actors, and entry points, then the abuses: a logged-out stranger, a logged-in stranger, a malicious tenant, a stolen laptop. It is a page, not a feeling that the app is “secure.”
Why does threat model matter when vibe coding?
Models add bcrypt and CORS and call it done. They never asked who the attacker is. A public marketing page and a multi-tenant inbox do not share a model.
How do you do threat model?
For this slice, write four lines: asset, attacker, entry, control. If you cannot name the attacker, you are not ready to add auth toys.
How do you ask a model for threat model?
Before coding defenses, write a short threat model for (feature): asset, attacker, entry point, and the control. Do not add generic security middleware that does not match that attacker.
What goes wrong with threat model?
A model that only lists “hackers.” Name the logged-in other customer. That is the attacker you actually have.