Domain 8 — Threat modeling ≠ bug fixing. Design decisions, attack paths, and vulnerabilities — not code quality.