# Threat Analysis Report

Generated: {YYYY-MM-DD}
Codebase: {project name from directory or package file}
Overall Risk Score: {X}/10
Total Endpoints: {N}
Protected Endpoints: {M}
Unprotected Endpoints: {N-M}

## Attack Surface Diagram

(Generate an ASCII diagram showing the external boundary, all endpoints
grouped by service/module, auth gates marked as [AUTH] or [OPEN],
input channels as arrows flowing in, and backend dependencies as arrows
flowing out. Adapt the diagram to what is actually found in the codebase.)

Example structure:
                        INTERNET
                           |
                +----------+----------+
                |    ENTRY POINTS     |
                +----------+----------+
                           |
          +----------------+----------------+
          |                |                |
    +-----+-----+   +-----+-----+   +-----+-----+
    | GET /api/  |   | POST /api |   | WS /ws    |
    | [AUTH]     |   | [OPEN!]   |   | [AUTH]    |
    +-----+-----+   +-----+-----+   +-----+-----+
          |                |                |
          +-------+--------+-------+--------+
                  |                |
            +-----+-----+   +-----+-----+
            |  Database  |   |  External |
            |            |   |  APIs     |
            +------------+   +-----------+

## Data Flow Diagram

(Generate an ASCII diagram for each critical data flow path showing
where input enters, what validation/auth steps it passes through,
and where it ends up. Mark missing steps.)

Example:
User Input --> [Validation?] --> [Auth?] --> [Handler] --> [DB Query]
                  ^                ^            |
                  |                |            v
              MISSING!         Present     [Response] --> User

## Executive Summary

{3-5 sentences summarizing:
 - Total attack surface size (endpoint count, input channels)
 - Biggest risk areas
 - Overall protection posture
 - Top priority action}

## Attack Surface Inventory

### Endpoints

| # | Method | Path | Auth | Rate Limited | Input Types | Score | OWASP |
|---|--------|------|------|-------------|-------------|-------|-------|
{one row per endpoint, sorted by score ascending}

### Input Channels

| # | Type | Location (file:line) | Validated | Sanitized | Flows To | Score |
|---|------|---------------------|-----------|-----------|----------|-------|
{one row per input channel}

### Authentication Boundaries

| # | Mechanism | Type | Scope | Strength | Gaps Found |
|---|-----------|------|-------|----------|------------|
{one row per auth boundary}

## Threat Details

(For each finding, ordered by score ascending — worst first)

### {Finding Title} — Score: {X}/10 [{CRITICAL|HIGH|MEDIUM|LOW|SECURE}]

**Location:** `{file}:{line}`
**OWASP Category:** {A01-A10 with name}
**Attack Scenario:**
{2-4 sentences describing a realistic attack exploiting this vector}

**Evidence:**
(show the relevant code snippet, 5-10 lines)

**Current Protections:**
- {list what is already in place}
- {or "None detected" if nothing found}

**Remediation:**
1. {specific fix with code guidance}
2. {additional hardening step}

**Priority:** {P0|P1|P2|P3}
- P0: Fix before next deploy (score 0-2)
- P1: Fix within 1 sprint (score 3-4)
- P2: Fix within 1 month (score 5-6)
- P3: Backlog improvement (score 7-8)

---

{repeat for each finding}

## Protection Scorecard

| Category | Score | Status |
|----------|-------|--------|
| Input Validation | {X}/10 | PROTECTED / PARTIAL / EXPOSED |
| Authentication | {X}/10 | PROTECTED / PARTIAL / EXPOSED |
| Authorization | {X}/10 | PROTECTED / PARTIAL / EXPOSED |
| Injection Prevention | {X}/10 | PROTECTED / PARTIAL / EXPOSED |
| Cryptography | {X}/10 | PROTECTED / PARTIAL / EXPOSED |
| Error Handling | {X}/10 | PROTECTED / PARTIAL / EXPOSED |
| Logging & Monitoring | {X}/10 | PROTECTED / PARTIAL / EXPOSED |
| CORS & Headers | {X}/10 | PROTECTED / PARTIAL / EXPOSED |
| Rate Limiting | {X}/10 | PROTECTED / PARTIAL / EXPOSED |
| **Overall** | **{X}/10** | **{verdict}** |

Status rules:
- EXPOSED: score 0-3
- PARTIAL: score 4-6
- PROTECTED: score 7-10

## Action Plan

### Immediate (P0) — Fix before next deploy
{numbered list of critical actions with file:line references}

### Short Term (P1) — Fix within 1 sprint
{numbered list}

### Medium Term (P2) — Fix within 1 month
{numbered list}

### Long Term (P3) — Backlog
{numbered list}

## Appendix

### Scanned Files
{count by type: N .java files, M .go files, etc.}

### Scan Methodology
- Static analysis of source code, configuration, and infrastructure files
- Pattern matching for known vulnerable patterns
- Code context analysis for confirmation
- OWASP Top 10 2021 classification
- Protection scoring based on 8 criteria (validation, auth, rate limiting, error handling, parameterized queries, TLS, CORS, logging)

### Limitations
- Static analysis only — does not detect runtime vulnerabilities
- Does not scan third-party dependency CVEs
- Pattern-based detection may miss custom frameworks
- Environment-variable-dependent security controls cannot be verified