OpenAI Security Threat Model: From STRIDE to code discipline, the practical transformation of threat modeling

Ask AI to do threat modeling for a warehouse, and what will most models give you back? A very professional-looking report, the structure is roughly like this: A component list, covering common gateways, caches, and databases A description of the attack surface, applying the OWASP taxonomy A few OWASP quotes to prove that you know what you are doing A bunch of "recommended verification input" mitigation measures Each of them is correct, but none of them can be applied to your code. When you take it for review, you can’t tell what’s wrong or what should be corrected. OpenAI has obviously been tortured by this problem. They put the security-threat-model Skill in the OpenAI/skills warehouse.