A curated list of threat modeling resources (Books, courses - free and paid, videos, tools, tutorials and workshops to practice on ) for learning Threat modeling and initial phases of security review.
Prevent merging of malicious code in pull requests
Ask Codex, Gemini, Grok, and 400+ OpenRouter models (Qwen, Kimi, DeepSeek) for second opinions or arbiter-mediated consensus. One MCP server for Claude Code, Codex, Cursor, Kiro, OpenCode. Measures the models' usefulness, too.
Claude Code plugin: universal radial-tree exploration engine. One tree skill + swappable presets (brainstorm / attack / design / code-audit) for divergent ideation, adversarial critique, and design-space exploration. 12 framings × hard-ban-on-incomplete-leaves × stable convergence.
Trace-backed Agent Authorization Reviews for tool-using AI agents. Staging-only evidence for payment, record-change, access, and export actions.
📚 Overview 🔒 Tooling 🔒 Process 🔒 Physical 🔒 People 📚
📚 VPS 🔒 Network 🔒 Cloud 🔒 Web Applications 📚
AI-powered whitebox penetration testing plugin for Claude Code. 9 languages, 22 skills, 7 autonomous agents. STRIDE threat modeling, OWASP 2025 coverage, polyglot monorepo support.
My Blockchain auditing service
A Claude / AI security review prompt for shipping safe apps. TRAP (True Readiness Audit Prompt) turns Claude Code, Cursor, or Copilot into an adversarial, evidence-first security & production-readiness audit of your own codebase.
ACS (Agnostic Config Suites) — AI coding agent skill system. 25+ auto-activating skills for Claude Code, Hermes, Kiro, Codex. Spec-driven dev, TDD, security review, architecture blueprints. One install, all agents upgraded.
Reviews and tests of security products
Spec-Kit extension for secure-by-design security reviews of full projects, staged changes, branches/PRs, plans, tasks, and follow-up actions
📚 IoT 🔒 Mobile 📚
Michael Adams — security specialist agent for Claude Code with persistent memory, STRIDE threat modeling, and OWASP framework mappings.
☁️ Multi-cloud security configuration review for AWS, Azure, GCP, and OCI. Read-only audits mapped to CIS, SOC 2, PCI DSS, NIST 800-53, and HIPAA, with remediation tracking to verify fixes over time. ✅
Evidence-driven acceptance gate for AI-generated software changes.
White-box AI code security review for Claude/Codex: offline scanner, review packs, SARIF, and report merging.
Repository-aware AI code review for coding agents — triage → 13 specialist reviewers → synthesis. Reviews what the agent changed and what the repo already knew. Claude Code, opencode, Cursor, Codex.
Claude Code skill: defensive security review of your own code (Apps Script, frontend, backend)
To associate your repository with the security-review topic, visit your repo's landing page and select "manage topics."