✳ Learning path / 4 lessons
From dependency to decision
Four lessons on threat-modeling a small checkout API, seeing transitive dependencies, separating who can write code from who can promote it, and using an SBOM as inventory evidence rather than as a control. Builds on risk, least privilege, and framework vocabulary. TrackPort’s client and TLS lesson stays in Foundations.
Work through the lessons in sequence, or choose the question you want to answer today.
01Map the shop: trust boundaries on a synthetic checkout API
Draw ShopCart’s data flows and trust boundaries, name an abuse case at each boundary, and write one control that still works if a network rule fails.
What you didn’t import still ships with you
Tell a direct dependency from a transitive one, name the risk of an unmaintained component, and list inventory sources you would actually open.
Who can write, who can promote
Map workstation to runtime, mark where a second person must approve promotion, and name a secret the writer must not hold.
Inventory, evidence, exposure, then the business
Use an SBOM as inventory evidence, then order a synthetic component finding by exploitation evidence, exposure, and business context.
Turn knowledge into a decision.
Once you have the ideas, try a short scenario. You’ll see why the tempting answer isn’t always the most useful one.
Open the practice range ↗