安全工程套件
威胁模型（STRIDE、LINDDUN）、攻击树、安全架构、安全编码、供应链安全（SLSA、SBOM）、ASVS 5.0 评审与渗透测试报告。
威胁建模
Threat Model Template (STRIDE)
完整STRIDE threat model: scope, DFD with trust boundaries, assets, threats per element, L x I rating, mitigations, risk acceptance
STRIDEPrivacy Threat Model Template (LINDDUN)
完整Privacy threat model by LINDDUN category: DFD with trust boundaries, data inventory, elicitation matrix, register, PETs, DPIA link
LINDDUN (threat categories)Attack Tree Analysis Template
标准Attack tree for one attacker goal: AND/OR tree as list and Mermaid, leaf cost/skill/likelihood, path analysis, countermeasures
Schneier attack trees
设计
Security Architecture Document Template (NIST SP 800-160, STRIDE)
完整Security architecture: assets, trust boundaries, STRIDE threat register, requirements, IAM, data protection, detection, residual risk
NIST SP 800-160 Vol. 1, STRIDESecure Coding Standard Template
标准Secure coding rules by area with do/don't code examples, SAST/DAST/secret scanning tooling and an exceptions process
Software Supply Chain Security Assessment Template (SLSA)
完整Supply chain assessment: SLSA 1.2 Build/Source levels, SBOM (SPDX, CycloneDX), provenance, Sigstore, Scorecard, VEX, CI/CD
SLSA 1.2
验证
Security Design Review Template (OWASP ASVS 5.0)
完整Design-time security review by the 17 OWASP ASVS 5.0 chapters: scope, DFD, threats, level, findings, remediation, sign-off
OWASP ASVS 4.0Penetration Test Report Template (PTES, OWASP WSTG)
完整Pentest report: executive summary, scope and rules of engagement, PTES phases, WSTG coverage, CVSS ratings, findings, retest
PTES; OWASP Web Security Testing Guide