A threat model says where a project can be attacked and what matters most if it is. Security keeps one per project under Security → Threat models, drafted from the code and edited by your team.
The draft
Coroid drafts the first version by reading the default branch, without an AI model, so the draft costs nothing. It runs in one of your agent slots like other scans. It reads JavaScript, TypeScript and Python, and finds:
- Entry points: HTTP routes and handlers, OpenAPI operations, queue consumers and command-line commands;
- Where trust changes: authentication middleware and other boundaries;
- Sensitive data: where configuration and secrets are read (names only, never values);
- writes that no authentication check guards.
The model has five sections: Entry points, Where trust changes, Sensitive data, What matters most, and Your notes. The draft also lists what it could not read and why: a file that was too large or unreadable, a language it does not read yet, or a limit it reached.
Your edits are kept
Every entry records who wrote it. Coroid never overwrites what a person wrote.
Each week, and whenever an owner or admin chooses Read the code again, Coroid reads the code again. It does not change the model. Instead it proposes changes: entries to add, update or remove. Owners and admins accept them into a new version, or dismiss them; a dismissed change is not proposed again.
When a change is accepted, Coroid skips anything that no longer fits: an entry a person has changed since, one that is already there, or one that is gone. It says what it skipped. Coroid proposes removing only what its own draft wrote, and only after a read that covered all the code. Your wording stays; only what Coroid found in the code changes.
Versions
Version 1 is the draft. Each accepted proposal or edit makes a new version, and the history says who did what: drafted from the code, edited by a person, Coroid's update added by a person, or imported from settings.
Who can change it
Everyone who can see a project can read its threat model. Owners and admins edit it, accept or dismiss proposals, and ask Coroid to read the code again.
How it is used
The security audit reads the threat model to decide which files to read first: code on the model's high-impact paths and entry points comes before the rest.
Settings portability
Each project's latest threat model travels in the organization settings bundle. Its history and open proposals stay where they are. See Settings portability.