Essential session storage is required to sign in. Optional analytics remain off unless you allow them.
For a small web app (your own, or a sample you control), produce a STRIDE threat model that identifies the main risks to its confidentiality, integrity, and availability, then write and APPLY a concrete hardening checklist: HTTPS-only with HSTS, a Content-Security-Policy, session cookies set HttpOnly+Secure+SameSite, least-privilege service/DB accounts, and patched dependencies. Deliver the threat model plus before/after evidence (e.g. response headers) of the hardening. Stay defensive — only assess systems you own or are authorized to.
A real STRIDE model mapping plausible threats to the app's CIA properties; risks prioritized by likelihood × impact.
Concrete controls applied and shown: HSTS/CSP, HttpOnly+Secure+SameSite cookies, least privilege, patched deps.
Security claims are accurate (e.g. hashing ≠ encryption; cookie attributes do what's stated); headers verified.
Only assesses owned/authorized systems; scope stated explicitly.
Use this README structure to make the work reviewable.
DevPath fetches a read-only, size-capped snapshot. Submitted code is never executed.
# A threat model & hardening checklist ## Goal For a small web app (your own, or a sample you control), produce a STRIDE threat model that identifies the main risks to its confidentiality, integrity, and availability, then write and APPLY a concrete hardening checklist: HTTPS-only with HSTS, a Content-Security-Policy, session cookies set HttpOnly+Secure+SameSite, least-privilege service/DB accounts, and patched dependencies. Deliver the threat model plus before/after evidence (e.g. response headers) of the hardening. Stay defensive — only assess systems you own or are authorized to. ## Acceptance criteria - [ ] Threat modeling: A real STRIDE model mapping plausible threats to the app's CIA properties; risks prioritized by likelihood × impact. - [ ] Hardening applied: Concrete controls applied and shown: HSTS/CSP, HttpOnly+Secure+SameSite cookies, least privilege, patched deps. - [ ] Correctness: Security claims are accurate (e.g. hashing ≠ encryption; cookie attributes do what's stated); headers verified. - [ ] Ethics: Only assesses owned/authorized systems; scope stated explicitly. ## Verification - [ ] Document installation and run commands. - [ ] Record automated checks and their exact commands. - [ ] Add representative output, screenshots, or a short demo where useful. - [ ] Confirm failure paths and known constraints. ## Decision log ### Decision title - Context: - Choice: - Alternatives considered: - Tradeoffs: ## Evidence - Link each rubric criterion to the file, test, or artifact that demonstrates it. ## Known limitations - List what is intentionally out of scope and what should be improved next.