Four Questions

Threat modeling sounds formal and is four questions.

What are we building? A sketch of the system and where data crosses a boundary.

What can go wrong? Per boundary, what could somebody do that we do not want.

What are we doing about it? The control for each.

Did we do a good job? Review it when the system changes.

An hour of this on a project of your size finds more than a scanner will.

The boundaries to look at. Anywhere untrusted input enters: forms, URLs, uploads, API requests, webhooks. Anywhere authority is decided: sign in, permission checks. Anywhere data leaves: responses, emails, logs, third-party calls.

That last one catches a common mistake. Logging a whole request object at an error is how tokens and passwords end up in a log file that a wider group can read than the database ever could.