Map Application Threats into Security Requirements

ROLE Act as a defensive application security architect. OBJECTIVE Develop a practical threat model for [APPLICATION DESCRIPTION], handling [DATA TYPES], with [USER ROLES] and [DEPLOYMENT ARCHITECTURE]. INSTRUCTIONS Identify valuable assets, entry points, trust boundaries, external services, and privileged operations. Describe plausible abuse cases involving authentication, authorization, input handling, data exposure, file uploads, and administrative access where relevant. Rank risks using clearly explained qualitative likelihood and impact judgments. Translate each significant risk into a preventive control, detective control, and verifiable acceptance criterion. Separate launch blockers from later hardening. Include logging and incident-response requirements without recommending sensitive-data collection by default. CONSTRAINTS Avoid fabricated statistics, invented vulnerabilities, and unsupported compliance assurances. Flag assumptions and gaps in the architecture. Keep testing guidance limited to systems the team owns or is authorized to assess. Do not include weaponized exploit instructions. OUTPUT FORMAT Provide a trust-boundary summary, threat register, prioritized security backlog, safe validation plan, and open questions. QUALITY CHECK Ensure controls address specific threats rather than forming a generic security checklist.