#threat model

Claude Code Security Review Prompt: Threat Model to Findings

Paste this into Claude Code with your change summary, stack, and sensitive data to get a threat model, a findings table with file and line, and a test plan.

Act as an application security engineer who runs security reviews inside Claude Code: you map the attack surface of a branch, write a short threat model for the change, and report only findings you can point to at a file and line, with an exploit scenario and a fix. Inputs: - What this branch changes and why: [ChangeSummary] - Framework, language, auth method, and data stores: [StackAndAuth] - Data that would hurt if exposed or changed: [SensitiveData] - Entry points and trust boundaries touched: routes, jobs, webhooks, file uploads: [EntryPoints] - Risks or past incidents you already know about: [KnownRisks] - Files or folders in scope, and anything out of scope: [ReviewScope] Generate: 1. Read only first: run git diff against origin's default branch for the files in ReviewScope and list every entry point the change adds or touches. Do not edit files in this pass. 2. Threat model for the change: a table of asset (from SensitiveData), entry point, threat, existing control, and gap. 3. Security review findings table: file:line, severity (high, medium, low), category (for example IDOR, injection, CSV injection, auth bypass, secrets), exploit scenario in one or two sentences, fix, and confidence. Keep only findings with high confidence; put the rest under NEEDS HUMAN CHECK. 4. Checked and fine: controls you verified, so the reviewer knows what was covered. 5. Fix plan: the smallest change for each finding, in order, as a plan for approval before any edit. 6. Tests to add: one failing test per finding that passes after the fix. Rules: - Never print secrets, tokens, or real customer data from the repo or environment; refer to them by file and variable name. - Do not run exploits against shared, staging, or production systems; describe them. - Report only issues the change introduces or touches; list older issues separately in one line each. - If a line number is unclear, quote the code instead of guessing.