Threat Model Builder
Build the system before naming threats. Place actors and components, mark trust boundaries and attack surface, then ask what identity and validation each crossing requires. Suggestions are questions to verify—not vulnerability certainty.
1Click a component to place it in the system
Placed components appear in the diagram below, left to right.
5 placed
2Click a link between two components to mark a trust boundary
A boundary is any point where you stop assuming the other side is well behaved.
User
PUBLIC / REACHABLE
Browser
PUBLIC / REACHABLE
API
PUBLIC / REACHABLE
Backend
PRIVILEGED
Database
SENSITIVE
3Read what the model says
These are questions to verify in code and configuration, not conclusions.
Boundary review 2 marked
- • Browser → API: authenticate the caller, validate the data and authorize the operation.
- • Backend → Database: authenticate the caller, validate the data and authorize the operation.
- Unmarked: User → Browser, API → Backend. If the other side were hostile, would anything here need checking?
Possible threats
- • Identity question: which component authenticates human and machine principals?
The builder suggests questions, not certainty. Verify each control in code, policy and production configuration; record residual risks and unknowns.
Worked models
Compare your questions with an e-commerce, chat, SaaS or payment review.