Threat Modelling for real use cases and business logic of application Don't ask about Pola... XSS, ask about how attacker, using only application logic can bypass its security.