This template builds on the fundamentals of threat modeling, tailoring them for the unique context of an open-source library. Libraries are building blocks; their security impacts every application that uses them. Thinking like an attacker about your library is a critical step in providing a robust, trusted component to the ecosystem.
- Consumers are Developers: Your users are other developers integrating your code. They rely on your library's integrity and correct behavior.
- Integration Points are APIs: The primary interface for attack and misuse is often your public API.
- Supply Chain Risk: Your dependencies are your dependencies' dependencies, and so on.
- Side Effects & Resource Usage: Unintended consequences or excessive resource consumption can impact host applications.