Skill UI

This guide details how to use OWASP Threat Dragon, an open-source tool, for comprehensive threat modeling. It enables security teams and developers to create data flow diagrams (DFD), identify potential vulnerabilities using standard methodologies like STRIDE and LINDDUN, and generate detailed threat reports. It is crucial for secure design review, risk assessment, and continuous security validation in DevSecOps pipelines.

A comprehensive guide and set of tools for performing deep security audits and implementing secure coding practices in Golang. It covers threat modeling (STRIDE), data flow tracing, input validation, cryptography, secrets management, and vulnerability prevention for critical areas like SQL injection and authentication.

Conducts STRIDE-A threat modeling on repositories or systems, running either a full single-pass analysis with architectures, DFDs, prioritized findings, and executive assessments, or an incremental update that compares a baseline report to the current code and highlights deltas.

This framework enforces high output quality, intellectual honesty, and continuous improvement across all AppSec agents. It mandates structured processes, including self-critique loops, anti-rationalization guards, and self-reflection quality gates (≥8 scoring). Applicable during code review, SAST, SCA, and threat modeling, it ensures rigorous and verifiable security analysis.