Merge "docs(spm): update threat model" into integration