Threat Model The Feature

End-of-lesson check

15 questions · take it digitally for instant feedback at tendril.neural-forge.io/learn/quiz/end-coder-threat-model-creators

1. What is the primary purpose of threat modeling before shipping a feature?

   1. To decide what programming language to use
   2. To make the feature run faster
   3. To identify potential ways the feature could be abused
   4. To reduce the number of lines of code needed

2. Which question should you NOT ask when threat modeling a new feature?

   1. What data should the app never expose?
   2. Who might want to abuse this feature?
   3. What is the most popular competitor's design?
   4. What rollback path exists if the output is wrong?

3. A developer is building a file upload feature using AI assistance. Which scope definition follows the lesson's guidance?

   1. Build a complete file management system with folders and sharing
   2. Build an upload feature that accepts images under 5MB
   3. Build the most secure upload system in the world
   4. Build something that handles files somehow

4. Why should you run AI-generated code as a user rather than as a developer?

   1. Because the AI only tests with non-developers
   2. Because developers cannot understand their own code
   3. Because the code only works for non-developers
   4. To identify security vulnerabilities from an attacker's perspective

5. What three things should you inspect before sharing AI-generated code with others?

   1. The diff, data access, and failure path
   2. The variable names, the comments, and the indentation
   3. The color scheme, the font size, and the loading animation
   4. The CPU usage, memory usage, and network speed

6. What does 'rollback path' refer to in the context of shipping AI features?

   1. A way to roll back the clock on your computer
   2. The strategy for reverting changes if the output causes problems
   3. A visual design element showing undo functionality
   4. A debugging technique for tracing errors

7. Which of these is NOT one of the key terms listed in the lesson?

   1. Permissions
   2. Security
   3. Threat model
   4. User interface

8. The lesson mentions that the 2026 security conversation keeps returning to what missing prompt?

   1. Which programming language to choose
   2. How to make the code run faster
   3. How many users will try the feature
   4. How the feature can be abused

9. A feature that exposes user passwords or private API keys to other users is an example of what?

   1. A performance issue
   2. A security vulnerability exposing data that should never be exposed
   3. A feature request
   4. A UI bug

10. What is the BEST test to prove a feature change works?

    1. Running the result as an actual user would
    2. Asking the AI if it works
    3. Checking that the code compiles without errors
    4. Reading through the code carefully

11. What is the main advantage of defining the smallest useful scope for an AI-generated feature?

    1. The agent can finish it faster and you can iterate
    2. It uses less computer memory
    3. It automatically includes all security features
    4. It requires fewer developers

12. What does it mean for an AI feature to be 'observable'?

    1. The feature can be seen on screen
    2. The feature has comprehensive logging and monitoring
    3. The feature uses visible UI elements
    4. The feature is open source

13. Why should AI-generated features be 'reversible'?

    1. Because it makes the code run faster
    2. To ensure the system can return to a safe state if AI output causes harm
    3. Because users like to undo actions
    4. Because code should always be written to be reversible

14. When threat modeling, why is it important to examine the failure path?

    1. To understand what happens when things go wrong and prevent security issues
    2. To show users error messages
    3. To log all failures for debugging
    4. To make the feature fail gracefully

15. What information should always be documented along with a shipped feature?

    1. A rollback path in case something goes wrong
    2. The company's revenue numbers
    3. The developer favorite coffee order
    4. The AI model version number only