# Threat Modeling

> Creates STRIDE-based threat models for JavaScript/TypeScript web applications. Use when the user asks for threat modeling, attack surface analysis, trust boundary mapping, or security architecture review.

- Skill: `leo4135/threat-modeling` (Agent Skill)
- Install (CLI): `npx skillmds@latest add leo4135/threat-modeling`
- Raw SKILL.md: https://api.skillmd.com/api/skills/leo4135/threat-modeling/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: leo4135 (https://skillmd.com/u/leo4135)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/leo4135/threat-modeling

---


# Threat Modeling for JavaScript Apps

## Workflow

1. **Identify assets** — data, credentials, business logic, infrastructure
2. **Draw trust boundaries** — browser ↔ CDN ↔ API ↔ DB ↔ third parties
3. **Enumerate entry points** — routes, WebSockets, webhooks, file uploads, cron
4. **Apply STRIDE** per component
5. **Prioritize threats** — likelihood × impact
6. **Map mitigations** — existing controls vs gaps

## Trust Boundary Template

```mermaid
flowchart LR
    User[User Browser]
    CDN[CDN / Edge]
    API[API Server]
    DB[(Database)]
    Ext[Third-Party APIs]

    User -->|HTTPS| CDN
    CDN -->|HTTPS| API
    API -->|TLS| DB
    API -->|HTTPS| Ext
```

Adapt to detected architecture (serverless, BFF, microservices, etc.).

## STRIDE Reference

| Threat | Definition | JS/TS Examples |
|--------|------------|----------------|
| **S**poofing | Pretending to be someone/something else | JWT forgery, session hijacking, SSRF via spoofed Host |
| **T**ampering | Modifying data or code | Parameter tampering, prototype pollution, MITM |
| **R**epudiation | Denying an action | Missing audit logs, unsigned webhooks |
| **I**nformation Disclosure | Exposing data to unauthorized parties | Verbose errors, `.env` in bundle, IDOR |
| **D**enial of Service | Disabling or degrading service | ReDoS, unbounded queries, event loop blocking |
| **E**levation of Privilege | Gaining unauthorized capabilities | Missing RBAC, mass assignment, path traversal |

## Threat Table Template

```markdown
| ID | Component | Threat (STRIDE) | Scenario | Likelihood | Impact | Risk | Existing Controls | Gap / Mitigation |
|----|-----------|-----------------|----------|------------|--------|------|-------------------|------------------|
| T-01 | /api/users/:id | I — IDOR | Attacker changes ID to access other users' data | High | High | Critical | JWT auth | No object-level auth check |
| T-02 | File upload | E — Path traversal | Upload `../../etc/passwd` filename | Medium | High | High | Multer filter | No path canonicalization |
```

## Attack Surface Checklist

Map each entry point:

| Entry Point | Auth Required? | Input Types | Data Accessed | Notes |
|-------------|----------------|-------------|---------------|-------|
| `POST /api/login` | No | JSON body | User credentials | Rate limit? |
| `GET /api/users/:id` | Yes | URL param | User PII | IDOR risk |
| `WS /chat` | Yes | Messages | Chat history | XSS if rendered |
| Webhook `/hooks/stripe` | Signature | JSON body | Payment events | Verify signature |

## Common JS/TS Threat Scenarios

### Client-Side
- XSS via unsanitized user content → session theft
- Sensitive data in localStorage → XSS exfiltration
- postMessage without origin check → data leak
- Client-side auth checks only → API bypass

### Server-Side (Node.js)
- Prototype pollution via `JSON.parse` + merge → RCE chain
- `child_process` with user input → command injection
- SSRF via `fetch(userUrl)` → internal network access
- ReDoS in validation regex → DoS

### Full-Stack Frameworks
- Next.js Server Actions without auth → unauthorized mutations
- API routes missing middleware → auth bypass
- Edge middleware bypass via direct API access

### Supply Chain
- Compromised npm package → credential theft
- Typosquatting dependency → backdoor

## Data Flow Diagram (DFD) Levels

**Level 0 — Context:**
```
[External User] → [Web Application] → [Database]
                         ↓
                  [Payment Provider]
```

**Level 1 — Decompose application:**
```
[Browser] → [Frontend SPA] → [API Gateway] → [Auth Service]
                                    ↓
                              [Business Logic] → [DB]
                                    ↓
                              [Object Storage]
```

## Prioritization Matrix

| | Low Impact | High Impact |
|---|-----------|-------------|
| **High Likelihood** | Medium | **Critical** |
| **Low Likelihood** | Low | High |

## Output

Deliver:
1. Trust boundary diagram (mermaid)
2. Attack surface table
3. STRIDE threat table with risk ratings
4. Top 5 threats requiring immediate attention
5. Recommended security controls per gap