Awesome Reviewers checks + prompts

Mitigation mapping

Checks whether each weakness is already mitigated by a control (validation, authorization middleware, rate limits) before reporting it.

V1061 technique
tactic Threat modeling
not detectable from CI configuration

Sub-techniques

2

IDNameDescription
V1061.001Control inventoryList the security controls and where they apply.
V1061.002Coverage checkReport entry points that bypass the controls.

Craft it

  1. List controls as code locations (middleware, decorators, gateways).
  2. Check each entry point passes through them.
  3. Report only unmitigated weaknesses.

Reverse engineer it

Signs that a codebase already runs this technique, and where to read how it is configured.

  • Auth middleware, rate limiter and validation layers in the code.

Open-source packages

2

Other techniques in Threat modeling