[THREAT] Identified threat: CDN caches authenticated responses keyed on the URL alone [RESPONSE] Dev/management: We have TLS in front of it. The transport is encrypted. #threatmodeling #infosec

[THREAT] Identified threat: Application containers mount /var/run/docker.sock for 'convenience' [RESPONSE] Dev/management: We're rewriting this as a microservice anyway. Defer until then. #threatmodeling #infosec

[THREAT] Identified threat: Real customer data is copied to staging weekly with no masking [RESPONSE] Dev/management: We only handle card data through a redirect, so PCI doesn't really apply. #threatmodeling #infosec

[THREAT] Identified threat: Password reset tokens are logged in plaintext in the access log [RESPONSE] Dev/management: It's open source. Many eyes will catch issues. #threatmodeling #infosec

[THREAT] Identified threat: Customer PII is forwarded to a marketing vendor with no DPA on file [RESPONSE] Dev/management: Marketing is technically a partner, not a vendor. #threatmodeling #infosec

[THREAT] Identified threat: Login endpoint has no rate limit and no account lockout [RESPONSE] Dev/management: Cyber insurance covers it. Moving on. #threatmodeling #infosec

[THREAT] Identified threat: Session ID is not rotated after login, enabling fixation attacks [RESPONSE] Dev/management: We passed the pen test last year, so we're good. #threatmodeling #infosec

[THREAT] Identified threat: Production pod runs as privileged with hostNetwork and the host PID namespace [RESPONSE] Dev/management: Out of scope for this team. #threatmodeling #infosec

[THREAT] Identified threat: Cookie value is unpickled server-side on every request [RESPONSE] Dev/management: the VP of Eng told me it's not an issue. #threatmodeling #infosec

[THREAT] Identified threat: AI coding assistant suggests dependency names that do not exist on the registry [RESPONSE] Dev/management: CVSS is only 6.8. We focus on 9+. #threatmodeling #infosec

[THREAT] Identified threat: JWT HS256 secret is the literal string 'secret' across all environments [RESPONSE] Dev/management: Legacy system. We're sunsetting it next quarter. #threatmodeling #infosec

[THREAT] Identified threat: MQTT broker accepts anonymous connections to all device topics [RESPONSE] Dev/management: the contractor told me it's not an issue. #threatmodeling #infosec

[THREAT] Identified threat: GitHub Actions reference third-party actions by branch name, not SHA [RESPONSE] Dev/management: Reproducible builds are overkill for us. #threatmodeling #infosec