# OWASP/pytm

A Pythonic framework for threat modeling

Repository: https://github.com/OWASP/pytm
Canonical: https://ross.abutalabs.com/products/pytm
Language: Python
License: NOASSERTION
License Family: other
Topics: data-flow-diagram, sequence-diagram, dfd, pythonic-framework, threats, threat-modeling, threat-modeling-from-code, secure-development, diagram, dataflow
Last push: 2026-08-19T13:30:24+00:00

## Health v2 (maintenance only)
Score: 85/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 98, release rhythm 60, longevity 100
- inputs: {"age_days": 3033, "days_push": 14, "days_rel": 58, "gap_med": null, "n_releases_24m": 1}
- flags: no_license
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1156, forks 228 (observed 2026-08-28T04:03:48.025654+00:00)

## What it is
pytm is a Pythonic framework from OWASP for threat modeling systems as code. Developers define their architecture in Python and it automatically generates data flow diagrams, sequence diagrams, and relevant threats.

## Use cases
- automate threat modeling for my system architecture
- generate a data flow diagram from code
- find threats in my design before implementation
- shift security threat modeling left in the SDLC
- generate sequence diagrams for my architecture
- do threat modeling as part of CI

## When to choose
- you want developer-centric, code-based threat modeling instead of manual diagrams
- you need automated DFD, sequence diagram, and threat report generation
- you want to integrate threat modeling into CI/CD pipelines

## When to avoid
- you need a GUI-based visual threat modeling tool
- you work on Windows natively without WSL
- you cannot install Java, Graphviz, and PlantUML dependencies

## Facets
- artifact type: framework
- maturity: active
- function: security, developer-tools, documentation, cli
- domain: security, developer-tools
- platform: python, cli
- tags: threat-modeling, data-flow-diagram, sequence-diagram, owasp, shift-left-security, secure-development, automation, linux, macos

## Member repositories
- OWASP/pytm (main) score 85

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:03:48.025654+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T06:32:06.121270+00:00, confidence not recorded.
  - readme: https://github.com/OWASP/pytm (fetched 2026-08-28T04:03:48.025654+00:00, sha 89a85c7a72dd)
  - registry_pypi: https://pypi.org/pypi/pytm/json (fetched 2026-08-29T12:37:07.028238+00:00, sha fc0e8a7e2282)
- Data as of 2026-08-30T08:39:29.467469+00:00.