Code Implications of Threat Models