stride-dread

STRIDE threat enumeration (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege) via prose judgment, plus deterministic DREAD severity scoring via executable script. Covers auth, authorization, session management, PII handling, API design, cryptography, secrets management, and key storage. Use proactively when reviewing authentication, authorization, or session management, designing APIs that handle user data or PII, reviewing cryptography or secrets management, performing threat modeling on new architecture, or running security-critical code review. Run the DREAD scorer for deterministic severity bands. Fallback: @include .claude/skills/security/stride-dread/SKILL.md