TEMPLATE.md

Weaponization Threat Model - Template

Add this to your design doc alongside your STRIDE / LINDDUN section.

Data flow name

Data elements

Data element	Enterprise use	Retention default	Correlation key	Authoritarian-tenant reading
e.g., session cookie	Auth persistence	30 days	User ID	Session-linked movement graph
e.g., approximate IP geo	Fraud scoring	90 days	User ID + timestamp	Per-user movement pattern
e.g., device fingerprint	Session anomaly detection	180 days	User ID + household	Household network graph
e.g., phone number	Account recovery	Indefinite	Real-name join	Real-name resolution of every pseudonymous account
...	...	...	...	...

Retention sunsets

For each retention default above longer than 30 days, answer:

• What is the specific product function that requires this window?
• What would break if the window were cut in half?
• Who owns the review that will extend or shorten this window in the future?

Owner-change review

Answer at least one of the following:

• What happens to this pipeline if the executive who scoped it leaves?
• What happens to this pipeline if the company is acquired?
• What happens to this pipeline if a nation-state compels access?

Non-goals

<explicit list of things this pipeline is NOT intended to enable, so that future feature requests that would enable them are flagged for re-review>

---

This template is licensed MIT. Fork it, replace it, or adopt only the fourth column - the specific artifact matters less than the commitment to run the exercise.