threat-model

Creates a codebase threat model from source code, past vulnerabilities, or an application owner's answers.

When to use it

Use when asked to build a threat model, map an attack surface, or identify what to worry about in a codebase.

Give it a target checkout; it writes THREAT_MODEL.md through an owner interview, unattended code research, or research followed by an interview.