Using semgrep to warn when your threatmodel-as-code has control gaps. <Insert big brain meme here>