Triages a vulnerability report (Dependabot, npm audit, composer audit) — reachable or not, exploitable in this app or not, and what to do this week versus later.

Sketches a threat model for a feature from its description and data flow — assets, entry points, top threats by STRIDE, and the mitigation that exists or is missing.