threat-modeling

STRIDE threat identification with coverage checking (prose judgment) plus deterministic STRIDE coverage and DREAD severity scoring via executable script. Covers system architecture security review, trust boundaries across services, auth, payments, and PII feature pre-implementation review, and threat model refresh sessions. Use proactively when designing or reviewing a new system architecture or API, running pre-implementation security review for features touching auth, payments, or PII, conducting threat modeling sessions (initial or refresh), or reviewing another team's threat model for completeness. Run the coverage checker for deterministic STRIDE gap and DREAD scoring.