feat(lab2): Threagile threat model + secure variant + auth flow

[semyonnadutkin]

Goal

Learn Threagile threat modeling, harden the security of an existing model, implement a feature-level threat model.

Changes

• Added submissions/lab2.md, labs/lab2/threagile-secure-model.yaml, labs/lab2/threagile-auth-model.yaml

Testing

The changes were verified by reviewing the generated reports (risks.json files).

Commands executed:

jq '
    [.[] |
      {severity, category, title,
       technical_asset: .most_relevant_technical_asset}] |
    sort_by(
      {"critical":5,"high":4,"elevated":3,"medium":2,"low":1}[.severity]
    ) |
    reverse |
    .[:5]
  ' labs/lab2/output-auth/risks.json

Observed output:

[
  {
    "severity": "high",
    "category": "sql-nosql-injection",
    "title": "<b>SQL/NoSQL Injection</b> risk at <b>Auth API</b> against database <b>User DB</b> via <b>Credential Lookup</b>",
    "technical_asset": "auth-api"
  },
  {
    "severity": "elevated",
    "category": "cross-site-scripting",
    "title": "<b>Cross-Site Scripting (XSS)</b> risk at <b>Token Signer</b>",
    "technical_asset": "token-signer"
  },
  {
    "severity": "elevated",
    "category": "cross-site-scripting",
    "title": "<b>Cross-Site Scripting (XSS)</b> risk at <b>Auth API</b>",
    "technical_asset": "auth-api"
  },
  {
    "severity": "elevated",
    "category": "cross-site-scripting",
    "title": "<b>Cross-Site Scripting (XSS)</b> risk at <b>Admin Endpoint</b>",
    "technical_asset": "admin-endpoint"
  },
  {
    "severity": "elevated",
    "category": "unguarded-access-from-internet",
    "title": "<b>Unprotected access from the internet</b> to <b>Auth API</b> via <b>Browser</b> through <b>Login and Registration</b>",
    "technical_asset": "auth-api"
  }
]

Artifacts & Screenshots

Artifacts

• submissions/lab2.md
• labs/lab2/threagile-secure-model.yaml
• labs/lab2/threagile-auth-model.yaml

Diagrams

Hardened Model

Diagram 1: Data flow in the hardened Threagile threat model

Authentication Model

Diagram 2: Data asset in the Threagile authentication threat model

Diagram 3: Data flow in the Threagile authentication threat model

Checklist

• Title is clear (feat(labN): <topic> style)
• No secrets or large temporary files committed
• Submission file at submissions/labN.md exists

• Task 1 — Baseline risk table + top 5 with STRIDE mapping
• Task 2 — Secure variant + risk difference table
• Bonus — Authentication flow model + 3 authentication-specific risks