sprint2–3 weeks~2h mentor time
Threat Model & Security Audit
Threat-model a real open-source application, find and prove three classes of issue, and write the report.
burpsemgrepthreat-modelling
The brief
Threat-model a real open-source application, find and prove three classes of issue, and write the report. The brief is deliberately incomplete — you make and justify the tradeoffs.
Deliberately ambiguous — you make and justify the tradeoffs. Your work is checked against a held-out evaluation you can't see in advance.
Milestones & mentor checkpoints
1Threat modelweek 1mentor review
2Findings with proofweek 2mentor review
3Report & remediationweek 3mentor review
How you're graded
Correctness
50% weight
Code quality
30% weight
Communication
20% weight