{"uid":"cap_ENZcmW7ZtuhVWXMV7k9jJ","slug":"supersentinel-threat-model-6f89d277","name":"SuperSentinel Threat Model","description":"Security intelligence. Audits contracts and code before attackers do.","url":"https://supersentinel.supercapital.fun/threat-model?utm_source=zero.xyz","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"input":{"type":"string","maxLength":8000,"minLength":1,"description":"Describe the architecture: components, data flows, auth and where it runs."}}},"responseSchema":{"type":"json","example":{"jobId":"j_…","output":"…","receipt":{"tx":"0x…","amount":"100000","network":"base"}}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.3","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.3/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.3","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.3","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_WOEaFB64gMX4o1BhsLofV","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.3","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Generates a security threat model for a described system architecture, identifying attack surfaces, vulnerabilities, and risks before attackers can exploit them.","exampleAgentPrompt":"Can you run a threat model on my system? It's a Node.js API behind a reverse proxy, uses JWT auth, talks to a Postgres database and an Ethereum smart contract for settlement, and runs on AWS ECS — I want to know the main attack surfaces and risks before we go live.","exampleUseCases":[{"title":"DeFi Protocol Pre-Launch Audit","prompt":"We're about to launch a DeFi lending protocol — it has a Solidity smart contract for collateral management, a React frontend talking to it via ethers.js, and a Node backend that handles liquidation triggers. Can you run a threat model on this architecture and tell me where attackers are most likely to strike?"},{"title":"SaaS App Architecture Security Review","prompt":"Before we ship our new B2B SaaS product, I want a threat model done on our setup: it's a multi-tenant Rails app, OAuth2 login via Google, PostgreSQL with row-level security, Redis for session caching, and it's deployed on GCP with Cloud Run. What are the biggest security risks?"},{"title":"Web3 Wallet Backend Assessment","prompt":"Can you threat-model our crypto wallet backend? It handles key derivation on the server side using HSMs, exposes a REST API over HTTPS for mobile clients, logs events to a centralized Kafka cluster, and connects to multiple EVM chains. I need to know what attack vectors we should harden before going to mainnet."}],"resultDescription":"Returns a JSON object containing a job ID, a detailed threat model output (identifying attack surfaces, threat actors, attack vectors, risk ratings, and mitigation recommendations for the described architecture), and a payment receipt with transaction hash, amount, and network.","failureModes":["Empty or too-vague architecture description returns unhelpful or generic threat model","Input exceeding 8000 characters is rejected","Payment failure results in 402 response with no threat model output","Ambiguous component descriptions may produce incomplete threat identification","Network or service downtime returns HTTP 5xx error"],"whenToPreferThis":"Choose SuperSentinel's threat model endpoint when you need automated, on-demand security threat modeling for a specific architecture description — especially useful for pre-launch security reviews of smart contracts, Web3 protocols, or traditional cloud applications. Prefer this over general-purpose LLM security advice when you want a structured, payable security intelligence output with a receipt. Best suited for architects and developers who can articulate their system components, data flows, and auth mechanisms in text form.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-21T07:19:33.066Z","isFirstParty":false,"canonicalSlug":"supersentinel-threat-model-6f89d277"}