threat-modeling

Use when a new feature, architecture, or significant design decision is being made. Run before any code is written. Produces a structured STRIDE threat model and architecture review that feeds directly into security requirements and PR review.