Verification · Threat modeling · Mitigation mapping
Control inventory
List the security controls and where they apply.
How to build it
- List each security control, such as auth middleware or a rate limiter, with its code location.
- Record which entry points each control covers.
- Keep the inventory in a threat model file that is reviewed with the code.
Signals in a repository
- A threagile.yaml or pytm model file in the repository.
- Auth middleware, rate limiter or validation modules named in the threat model.
- A security section in the docs that lists controls and their files.
In practice
No scanned repository runs a tool for this check. The steps above are the only guidance.