Essential session storage is required to sign in. Optional analytics remain off unless you allow them.
Pick an LLM application you can describe (a RAG chatbot, a coding assistant, a support agent) and produce a DEFENSIVE threat model. Map its realistic failure CLASSES to the OWASP Top 10 for LLM Applications (2025) — at minimum Prompt Injection (LLM01, direct vs indirect), Sensitive Information Disclosure, and Excessive Agency — identify the assets and trust boundaries, and for EACH risk specify a concrete DEFENSE (least privilege, treat-retrieved-content-as-untrusted, output validation, human-in-the-loop, data minimization). Stay strictly conceptual and defensive: name categories and mitigations only — NO attack payloads, jailbreak strings, or step-by-step exploit instructions.
Realistic failure classes correctly mapped to OWASP LLM Top 10; assets + trust boundaries identified; direct vs indirect injection understood.
Each risk has a concrete, correct mitigation (least privilege, untrusted-I/O, validation, human-in-the-loop, data minimization).
Conceptual/defensive throughout — no payloads, jailbreak strings, or exploit steps.
Use this README structure to make the work reviewable.
DevPath fetches a read-only, size-capped snapshot. Submitted code is never executed.
# An AI threat model & OWASP mapping ## Goal Pick an LLM application you can describe (a RAG chatbot, a coding assistant, a support agent) and produce a DEFENSIVE threat model. Map its realistic failure CLASSES to the OWASP Top 10 for LLM Applications (2025) — at minimum Prompt Injection (LLM01, direct vs indirect), Sensitive Information Disclosure, and Excessive Agency — identify the assets and trust boundaries, and for EACH risk specify a concrete DEFENSE (least privilege, treat-retrieved-content-as-untrusted, output validation, human-in-the-loop, data minimization). Stay strictly conceptual and defensive: name categories and mitigations only — NO attack payloads, jailbreak strings, or step-by-step exploit instructions. ## Acceptance criteria - [ ] Threat model quality: Realistic failure classes correctly mapped to OWASP LLM Top 10; assets + trust boundaries identified; direct vs indirect injection understood. - [ ] Defenses: Each risk has a concrete, correct mitigation (least privilege, untrusted-I/O, validation, human-in-the-loop, data minimization). - [ ] Stays defensive: Conceptual/defensive throughout — no payloads, jailbreak strings, or exploit steps. ## Verification - [ ] Document installation and run commands. - [ ] Record automated checks and their exact commands. - [ ] Add representative output, screenshots, or a short demo where useful. - [ ] Confirm failure paths and known constraints. ## Decision log ### Decision title - Context: - Choice: - Alternatives considered: - Tradeoffs: ## Evidence - Link each rubric criterion to the file, test, or artifact that demonstrates it. ## Known limitations - List what is intentionally out of scope and what should be improved next.