ALL-SECU1003 · threat_model_coverage
Judge whether current threat analysis covers each relevant security boundary.
This is a contextual rule for all languages. Read its implementation.
Definition
Section titled “Definition”Compare in-scope boundaries with their assets, flows, actors, threats, mitigations, residual risks, ownership, review age, and any named inherited model. Judge whether the evidence covers the actual boundary rather than counting a generic checklist.
Evidence
Section titled “Evidence”Findings cite raw boundary and threat evidence, including the owner, review age, and inherited model when one supplies the analysis.
Exceptions
Section titled “Exceptions”A component may inherit a current parent threat model when the retained evidence names it and
shows that its boundary is covered. A repository with no meaningful security boundary may be
not_required.
Examples
Section titled “Examples”A current public API model covering assets, trust crossings, actors, abuse paths, mitigations,
and accepted residual risks is complete. A model for an old architecture is stale or
misaligned even when every document section exists.
References
Section titled “References”- Cites “OWASP Threat Modeling Cheat Sheet”
- Cites “NIST Secure Software Development Framework”
- Cites “Microsoft Security Development Lifecycle”, threat modeling