Your threat model, for AI.

Three steps

AI setup

Add one of these to your AI assistant so it always knows how to produce threat model files.

# Threat modeling
When asked to create or update a threat model, produce a `.justappsec` file
following the JustAppSec v1 schema at https://justappsec.com/threat-model/schema

The file lives next to the code it describes (e.g. `threat-model.justappsec`).
Open it at https://justappsec.com/threat-model to review and triage threats visually.
Output only raw JSON — no markdown fences, no explanation.

# Threat modeling
When I ask you to create a threat model, output a .justappsec file following
the JustAppSec v1 schema at https://justappsec.com/threat-model/schema
- Output ONLY raw JSON — no markdown fences, no explanation
- Place the file at the root of the repository (e.g. threat-model.justappsec)
- Generate 15-25 threats total, technology-specific — no generic filler
- Use consistent component names across all threats
- After generating: remind me to open it at https://justappsec.com/threat-model

You produce JustAppSec v1 threat models as .justappsec files when asked.
Schema reference: https://justappsec.com/threat-model/schema

Key rules:
- Output only raw JSON — no markdown fences, no explanation
- Use the v1 format: { version: "1", meta: {...}, threats: [...] }
- threats is a flat array — each threat has id, title, description, severity, status, path
- path is an ordered array of component names the attack traverses
- Use consistent component names across all threats
- Add technology-specific threats; no generic filler text
- Most threats status "open"; mark proven mitigations as "closed" with closeReason "mitigated"

Schema reference

The full structure of a .justappsec v1 file.

{
  "version": "1",
  "meta": {
    "name": "My API",
    "created": "2026-01-01T00:00:00.000Z",
    "modified": "2026-01-01T00:00:00.000Z"
  },
  "threats": [
    {
      "id": "t1",
      "title": "SQL injection via search endpoint",
      "description": "The GET /api/products?q= parameter is concatenated into a raw SQL query without parameterisation. An attacker can exfiltrate the entire users table or escalate to DBA via stacked queries on PostgreSQL.",
      "severity": "critical",
      "status": "open",
      "path": ["Attacker", "API Server", "PostgreSQL"],
      "category": "Injection",
      "owner": null
    },
    {
      "id": "t2",
      "title": "JWT algorithm confusion (RS256 → HS256)",
      "description": "The auth service trusts the 'alg' JWT header field without allowlisting RS256. An attacker signing a forged token with HS256 using the public key as the HMAC secret can impersonate any account.",
      "severity": "critical",
      "status": "open",
      "path": ["Attacker", "Auth Service", "All Protected APIs"],
      "category": "Spoofing",
      "owner": null
    },
    {
      "id": "t3",
      "title": "Missing HTTPS on internal service mesh",
      "description": "Traffic between the API Server and internal microservices uses plain HTTP. A compromised container in the same network namespace can intercept or tamper with requests.",
      "severity": "medium",
      "status": "closed",
      "closeReason": "mitigated",
      "path": ["API Server", "Auth Service"],
      "category": "Info Disclosure",
      "owner": "@platform-team"
    }
  ]
}