List the threats in a password reset design

About this exercise

Before the design review, list threats for this password reset spec. Write exactly 4 numbered lines like '1. (step 2) Threat: ... | Mitigation: ...', each starting with the spec step it comes from. Don't list protections the spec already has as missing. Plain text, under 150 words.

Common mistakes when you ask AI for this

• A generic checklist. The AI lists OWASP-style threats like XSS and CSRF that aren't tied to this design. Try: Say: "Start each line with the spec step it comes from, like (step 2)."
• Flagging what's already built. The AI recommends rate limiting even though the spec has it. Try: Add: "Don't list protections the spec already has."
• No shape. The AI writes a long threat model with STRIDE headings. Try: Show it: "Exactly 4 lines: Threat: ... | Mitigation: ..."
• Trusting the AI to count words. AI is bad at counting. Ask for "under 120 words" and it often lands well over. Try: Ask for less than the limit and cap each line: "each line under 15 words, under 90 words total."

What a strong prompt includes

• Ties threats to the spec
• Skips existing protections
• Shows the line shape
• Says exactly how many
• Sets a word limit

Practice this now ↑

Related exercises

• Accept a job offer and confirm the exact terms (Writing AI · Job seekers)
• Answer a 'where is my order' email with the real new date (Writing AI · Customer support teams)
• Answer a big discount ask with two priced options (Writing AI · Sales and customer success)
• Answer a buyer's HOA questions from the bylaws (Research & AI Search · Real estate agents)
• Answer a charge nurse application question with evidence (Writing AI · Nurses and healthcare workers)