Download and import the Security Threat Modeler JSON preset
Save `security-threat-modeler.json` and import it into Vezz me.
Security Threat Modeler Prompt: STRIDE audits and exploit precondition analysis.
Download the Security Threat Modeler JSON preset for Vezz me. Highlight code diffs, API specs, or CVE advisories to identify STRIDE threats and exploit preconditions.
Best fit
Best for AppSec engineers, backend developers, and cloud architects reviewing PR diffs, webhook specs, IAM policies, and CVE advisories.
On-screen walkthrough
How this looks on a real webpage.
Instead of switching tabs and rebuilding context, highlight the exact passage that slowed you down and press your shortcut (default: Ctrl+Shift+X or Cmd+Shift+X on macOS, fully customizable in settings).
1. Highlighted on page (GitHub Pull Request — Webhook Preview Endpoint)
app.post('/api/webhooks/preview', requireAuth, async (req, res) => { const { targetUrl, customHeaders } = req.body; if (!targetUrl.startsWith('https://')) return res.status(400).send('HTTPS required'); const response = await fetch(targetUrl, { headers: customHeaders }); return res.json({ status: response.status, preview: (await response.text()).slice(0, 500) }); });
Ctrl+Shift+X“Threat-model this code/spec for attacker-controlled inputs and bypass vectors.”
2. Vezz me on-screen answer overlay
1. **Attacker Control**: Any logged-in user controls `targetUrl` (if prefixed with `https://`) and `customHeaders`.
2. **Threat Vectors**:
- **302 Redirect Downgrade SSRF**: `fetch()` follows HTTP redirects by default! An attacker can pass `https://evil.example/ hop`, which returns `302 Location: http://169.254.169.254/latest/meta-data/iam/`, bypassing `startsWith('https://')` and leaking cloud IAM keys.
- **Internal HTTPS SSRF / DNS Rebinding**: `https://10.0.0.1` or internal k8s services still start with `https://`.
3. **Defense-in-Depth Fix**: Set `redirect: 'error'` on `fetch()` and use a custom socket dispatcher that resolves DNS and blocks RFC 1918, loopback (`127.0.0.0/8`), and link-local (`169.254.0.0/16`) IPs.
3. Suggested follow-up questions in thread
- “Write the Node.js custom lookup function that blocks private IPv4 and IPv6 ranges.”
- “What response size limit should we add so `await response.text()` cannot OOM the process?”
Importable Prompt Preset
Use this custom prompt in Vezz me.
Copy the system prompt below or download the .json preset file to import it directly into the Vezz me Chrome or Firefox extension.
Vezz me Custom Prompt Preset
Security Threat Modeler
Shifts analysis from 'does this code work for honest users?' to 'how do components compose when an attacker controls headers, redirects, or concurrency?'
Act as a Principal Application Security Engineer threat-modeling the selected code, API design, IAM policy, or vulnerability advisory: 1) Trust Boundary & Attacker Control: identify which inputs, headers, tokens, or redirects an attacker controls, 2) High-Impact Threat Vectors: list the top 2–3 concrete security risks (e.g., BOLA/IDOR, SSRF, TOCTOU race condition, signature bypass, injection, privilege escalation) with a realistic exploit scenario, 3) Exploit Preconditions: state what must be true for this to be exploitable, and 4) Defense-in-Depth Fix: provide the exact code or policy remediation.Step-by-step workflow
How to run this workflow in place.
Highlight a PR diff, API spec, IAM policy, or CVE description
Select the relevant code or design doc section in your browser.
Review the exploit scenario and apply the defense-in-depth fix
Verify whether the identified preconditions apply to your deployment and copy the hardened remediation.
Key details
Why this approach works better than switching tabs.
Frequently asked questions
Common questions about appsec & threat modeling preset.
Does this preset work on architectural design docs as well as code?
Yes! Highlight a design doc section describing OAuth flows, multi-tenant isolation, or webhook delivery to get an architectural threat model.
Can I use it to triage Dependabot and Snyk alerts?
Yes. Because Step 3 of the prompt isolates Exploit Preconditions, it excels at telling you whether a transitive CVE is actually reachable.
What permissions does Vezz me require on my browser?
Only activeTab and storage. Vezz me has zero background scripts and never accesses internal source code unless you highlight and submit it.
Related workflows & guides
Explore connected pages.
Ready to try this workflow on your own reading?
Install Vezz me free, highlight text on any webpage, and press your customizable shortcut (default: Ctrl+Shift+X or Cmd+Shift+X on Mac) to get an answer right beside the source.
