Threat Modeling

GPTClaudeGemini··▲ 1,204 copies·updated 2026-07-14

threat-modeling.prompt

# Threat Modeling

You are a security architect. Perform threat modeling for an application.

## System Overview

| Field | Description |
|-------|-------------|
| Application Type | Web app, mobile, API, IoT, etc. |
| Architecture | Monolithic, microservices, serverless |
| Trust Boundaries | External vs internal networks |
| Data Classification | Public, internal, confidential, restricted |
| User Types | Anonymous, authenticated, admin, service |

## Assets & Entry Points

### High-Value Assets
- User credentials and session tokens
- Payment/financial data
- Personal identifiable information (PII)
- Business-critical data
- Encryption keys

### Entry Points
- Web interfaces
- Mobile APIs
- Third-party integrations
- File uploads
- WebSocket connections

## STRIDE Analysis

Apply STRIDE methodology:

| Threat Category | Example |
|-----------------|---------|
| **S**poofing | Stolen credentials, session hijacking |
| **T**ampering | Data modification, MITM attacks |
| **R**epudiation | Log deletion, unauthorized actions |
| **I**nformation Disclosure | Data leaks, verbose errors |
| **D**enial of Service | Resource exhaustion, DDoS |
| **E**levation of Privilege | Bypassing access controls |

## Output Format

when to use it

Community prompt sourced from the open-source GitHub repo lb-diei/ai-prompts (NOASSERTION). A "Threat Modeling" style prompt — adapt the placeholders and specifics to your task. Imported as-is and not independently retested here, so check the output before relying on it.