<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Privacy Threat Modeling — API Reference

## LINDDUN Analysis

```bash
node scripts/agent.js --action linddun \
  --component "COMPONENT_NAME" --data-categories "name,email,location"
```

## 5-Question Framework

```bash
node scripts/agent.js --action five-questions \
  --asset "ASSET_NAME" --adversary "tier-1|tier-2|tier-3"
```

## Score Threats

```bash
node scripts/agent.js --action score \
  --threats '[{"name":"THREAT","likelihood":"possible","impact":"high"}]'
```

## Map Mitigations

```bash
node scripts/agent.js --action mitigations --threats /tmp/scored_threats.json
```

## LINDDUN Categories

| Letter | Threat | Mitigation |
|--------|--------|------------|
| L | Linkability | Anonymization, mix networks |
| I | Identifiability | k-anonymity, differential privacy |
| N | Non-repudiation | Deniable encryption |
| D | Detectability | Dummy traffic, ORAM |
| D | Disclosure | Encryption, access controls |
| U | Unawareness | Transparency, privacy notices |
| N | Non-compliance | Consent management, PbD |

## Adversary Tiers

| Tier | Capability | Example |
|------|-----------|---------|
| tier-1 | Casual, basic tools | Curious co-worker |
| tier-2 | Motivated, moderate skill | Data broker, cybercriminal |
| tier-3 | Resourced, persistent | APT, nation-state |

## Risk Matrix

| Likelihood \ Impact | Low | Medium | High | Very High |
|--------------------|-----|--------|------|-----------|
| Unlikely | LOW | LOW | MEDIUM | MEDIUM |
| Possible | LOW | MEDIUM | HIGH | HIGH |
| Probable | MEDIUM | HIGH | VERY HIGH | VERY HIGH |
