Skip to main content
idapt
HomeCodeAI ModelsPricing
Sign inStart free
  • Home
  • Pricing
  • AI Models
  • Image models
  • Voice models
  • Video models
  • Rankings
  • New models
  • Model status
  • Multi-Model Chat
  • Voice Mode
  • Voice HUD
  • Web Search
  • Image Generation
  • Video Generation
  • Audio Generation
  • Transcription
  • Drive
  • Credentials
  • Sharing
  • Workspaces
  • Tasks
  • Memory
  • Agents
  • Subagents
  • Automations
  • Skills
  • idapt Code
  • Code Execution
  • Computers
  • Computer Use
  • Computer Assist · Soon
  • Containers
  • Cloud Computers
  • Local AI
  • AI Gateway
  • API & SDK
  • CLI
  • MCP
  • Tunnels
  • All features →
  • LLM cost calculator
  • Token counter
  • Context window checker
  • Can I run it
  • Model picker quiz
  • Savings finder
  • Video cost estimator
  • Text to speech cost
  • Transcription cost
  • API endpoint tester
  • All free tools →
  • Blog
  • Use cases
  • Comparisons
  • Best of
  • Skills
  • Learn
  • Changelog
  • Help center
  • FAQ
  • Privacy
  • Compare all models
  • Support
  • idapt Code
  • Developers
  • Quickstarts
  • API reference
  • API pricing
  • CLI
  • MCP
  • Downloads
  • Desktop
  • Badges and embeds
© idapt[email protected]TermsPrivacy PolicyLegal noticeReport content
X (Twitter)
All skills
Code

Threat model a system

STRIDE against a real data-flow diagram, with mitigations ranked by exposure.

Fill it in

Components, data flows, and where the trust boundaries are.

A data-flow diagram, in code.

So the list is actionable rather than exhaustive.

Your prompt

Threat model this system.

[the system]

Draw the data-flow diagram first, in code, with the trust boundaries marked. Half
the value of threat modelling is the argument that happens while drawing it,
because that is when someone says "wait, that talks directly to the database".
Walk STRIDE per element, not per system. Applied to the whole application it
produces generic findings; applied to one data flow it produces "the webhook
endpoint accepts unsigned payloads".

Rank by exposure and impact, and cut anything you would not act on. An
exhaustive threat model is read once and filed; twelve ranked items with
mitigations get done.
Name the assumptions the model depends on. Those are what change.
Use Threat model a systemOpens with everything above already filled in.

Why this works

STRIDE applied to a whole application produces generic findings. Applied per data flow it produces "the webhook endpoint accepts unsigned payloads". Half the value is the argument that happens while drawing the diagram, so it draws one.

More code skills

  • idapt Code
  • Fix a failing test

Use it now in a chat in 1 click

Use Threat model a system
Fix a GitHub issue
  • Find security bugs
  • Ship a feature
  • Speed up slow code