---
title: "Security Threat Modeler Prompt: STRIDE audits and exploit precondition analysis."
description: "Download the Security Threat Modeler JSON preset for Vezz me. Highlight code diffs, API specs, or CVE advisories to identify STRIDE threats and exploit preconditions."
canonical_url: "https://vezz.me/prompts/security-threat-modeler/"
type: "pseo-prompts"
category: "prompts"
topic: "AppSec & Threat Modeling Preset"
intent: "Best for AppSec engineers, backend developers, and cloud architects reviewing PR diffs, webhook specs, IAM policies, and CVE advisories."
---

# Security Threat Modeler Prompt: STRIDE audits and exploit precondition analysis.

Download the Security Threat Modeler JSON preset for Vezz me. Highlight code diffs, API specs, or CVE advisories to identify STRIDE threats and exploit preconditions.

> **Best fit:** Best for AppSec engineers, backend developers, and cloud architects reviewing PR diffs, webhook specs, IAM policies, and CVE advisories.

## Live Webpage Walkthrough

- **Source:** GitHub Pull Request — Webhook Preview Endpoint (`github.com/org/platform/pull/891/files`)
- **Recommended Context Mode:** Detailed

**Highlighted Passage:**
> app.post('/api/webhooks/preview', requireAuth, async (req, res) => {
  const { targetUrl, customHeaders } = req.body;
  if (!targetUrl.startsWith('https://')) return res.status(400).send('HTTPS required');
  const response = await fetch(targetUrl, { headers: customHeaders });
  return res.json({ status: response.status, preview: (await response.text()).slice(0, 500) });
});

**User Question (Shortcut):** "Threat-model this code/spec for attacker-controlled inputs and bypass vectors."

**Vezz me On-Screen Answer:**
1. **Attacker Control**: Any logged-in user controls `targetUrl` (if prefixed with `https://`) and `customHeaders`.
2. **Threat Vectors**:
   - **302 Redirect Downgrade SSRF**: `fetch()` follows HTTP redirects by default! An attacker can pass `https://evil.example/ hop`, which returns `302 Location: http://169.254.169.254/latest/meta-data/iam/`, bypassing `startsWith('https://')` and leaking cloud IAM keys.
   - **Internal HTTPS SSRF / DNS Rebinding**: `https://10.0.0.1` or internal k8s services still start with `https://`.
3. **Defense-in-Depth Fix**: Set `redirect: 'error'` on `fetch()` and use a custom socket dispatcher that resolves DNS and blocks RFC 1918, loopback (`127.0.0.0/8`), and link-local (`169.254.0.0/16`) IPs.

**Suggested Follow-Ups:**
- "Write the Node.js custom lookup function that blocks private IPv4 and IPv6 ranges."
- "What response size limit should we add so `await response.text()` cannot OOM the process?"

## Custom Prompt Preset for Vezz me

- **Preset Name:** Security Threat Modeler
- **Recommended Context Level:** Detailed
- **JSON Preset Download:** https://vezz.me/prompts/presets/security-threat-modeler.json

```text
Act as a Principal Application Security Engineer threat-modeling the selected code, API design, IAM policy, or vulnerability advisory: 1) Trust Boundary & Attacker Control: identify which inputs, headers, tokens, or redirects an attacker controls, 2) High-Impact Threat Vectors: list the top 2–3 concrete security risks (e.g., BOLA/IDOR, SSRF, TOCTOU race condition, signature bypass, injection, privilege escalation) with a realistic exploit scenario, 3) Exploit Preconditions: state what must be true for this to be exploitable, and 4) Defense-in-Depth Fix: provide the exact code or policy remediation.
```

**Why it works:** Shifts analysis from 'does this code work for honest users?' to 'how do components compose when an attacker controls headers, redirects, or concurrency?'

## Step-by-step workflow

1. **Download and import the Security Threat Modeler JSON preset**: Save `security-threat-modeler.json` and import it into Vezz me.
2. **Highlight a PR diff, API spec, IAM policy, or CVE description**: Select the relevant code or design doc section in your browser.
3. **Review the exploit scenario and apply the defense-in-depth fix**: Verify whether the identified preconditions apply to your deployment and copy the hardened remediation.

## Why naive checks pass functional review but fail AppSec review

Security vulnerabilities rarely look like obvious syntax errors; they happen at trust boundaries where URL parsers, HTTP redirects, or database transactions interact.

- Checks for SSRF redirect bypasses, BOLA/IDOR object-ownership gaps, and JWT/webhook signature confusion
- Spots race conditions (TOCTOU) on balance checks, coupon redemptions, and rate limiters
- Identifies AWS IAM privilege escalation paths (`iam:PassRole`, `sts:AssumeRole`, wildcard resources)

## Frequently asked questions

### Does this preset work on architectural design docs as well as code?

Yes! Highlight a design doc section describing OAuth flows, multi-tenant isolation, or webhook delivery to get an architectural threat model.

### Can I use it to triage Dependabot and Snyk alerts?

Yes. Because Step 3 of the prompt isolates Exploit Preconditions, it excels at telling you whether a transitive CVE is actually reachable.

### What permissions does Vezz me require on my browser?

Only activeTab and storage. Vezz me has zero background scripts and never accesses internal source code unless you highlight and submit it.

## Related guides

- [Summarize CVE & Security Advisories Workflow](https://vezz.me/use-cases/summarize-cve-and-security-advisories/): How to triage NVD and GitHub Security Advisories rapidly.
- [Vezz me for Cybersecurity Analysts](https://vezz.me/for/cybersecurity-analysts/): Security-focused browser workflows and permission guarantees.
- [GitHub & Source Code Privacy Audit](https://vezz.me/permissions/github-and-source-code-privacy/): Why activeTab protects private repositories from passive scraping.
- [Senior Engineer Code Reviewer Preset](https://vezz.me/prompts/senior-engineer-code-reviewer/): Broader code review preset covering concurrency, types, and reliability.