Please apply the following diffs and create a pull request.
Once the PR is ready, give it a title based on the messages of the fixes being applied.

[{"message":"Corrected spacing in 'cert error' to 'certificate error' for clarity and consistency with technical terminology.","fixFiles":[{"filePath":"THREATMODEL.md","diff":"diff --git a/THREATMODEL.md b/THREATMODEL.md\n--- a/THREATMODEL.md\n+++ b/THREATMODEL.md\n@@ -149,7 +149,7 @@\n \n |                   |                                                                                                                                |\n | ----------------- | ------------------------------------------------------------------------------------------------------------------------------ |\n-| **Description**   | Caller passes `httpsAgent: new https.Agent({ rejectUnauthorized: false })` to \"fix\" a cert error in dev, ships it to prod.     |\n+| **Description**   | Caller passes `httpsAgent: new https.Agent({ rejectUnauthorized: false })` to \"fix\" a certificate error in dev, ships it to prod. |\n | **Likelihood**    | Medium (very common copy-paste anti-pattern)                                                                                   |\n | **Impact**        | High (silent MITM)                                                                                                             |\n | **In scope?**     | **No.** axios delegates TLS entirely to Node's `https` module / the browser. We do not inspect or warn on agent configuration. |\n"}]},{"message":"Missing period at the end of the sentence fragment 'to publish out of band'.","fixFiles":[{"filePath":"THREATMODEL.md","diff":"diff --git a/THREATMODEL.md b/THREATMODEL.md\n--- a/THREATMODEL.md\n+++ b/THREATMODEL.md\n@@ -402,7 +402,7 @@\n \n |                 |                                                                                                                                                                                                                                                                                                            |\n | --------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |\n-| **Description** | Attacker with write access force-pushes an existing tag to point at a malicious commit, or pushes `v1.99.99` to publish out of band.                                                                                                                                                           |\n+| **Description** | Attacker with write access force-pushes an existing tag to point at a malicious commit, or pushes `v1.99.99` so that a release is published out of band.                                                                                                                                      |\n | **Likelihood**  | Low (requires write access - assumed compromised at that point)                                                                                                                                                                                                                                            |\n | **Impact**      | High                                                                                                                                                                                                                                                                                                       |\n | **Mitigations** | • npm rejects re-publishing an existing version - re-tagging you cannot overwrite the published `1.15.0`. <br>• Provenance attestation records the commit SHA the tag pointed to _at publish time_ - forensically verifiable. <br>• GitHub tag protection rules can prevent tag deletion/force-push. |\n"}]}]