Asking "What can go wrong?" at the code level helps identify potential issues before they reach production. When practiced in pairs or small teams, it also helps junior engineers develop judgment about code quality. Practical contexts for code-level threat awareness include:
- Merge Reviews: Reviewing an entire codebase is not practical because the code continues to change. Scoping a review to the changeset of a merge provides clear context and responsibility. Earlier is less costly, and merge reviews make earlier the default.
- Static Analysis: Reviewing static analysis results, particularly when scoped to a merge request, with the intent of going deeper using the Four Question Framework can surface impact that automated tools alone would not flag.
- Pair Programming: Pair programming facilitates knowledge sharing, helps prevent security issues early, and builds comfort with the "What can go wrong?" question.
Code-level threat findings should feed back into the broader Threat Model so that threats can be assessed from a design perspective. This can surface design-level solutions that are more maintainable and scale better than localized fixes.