Using a lightweight threat model to focus security work on a small project — figuring out what's actually worth protecting, and which alerts to safely ignore.