OWASP/threat-dragon

Health v2 · maintenance only

Adoption not part of the score

1572 stars · 397 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

OWASP Threat Dragon is a free, open-source, cross-platform threat modeling application for drawing data flow diagrams and listing threats for diagram elements. It supports STRIDE, LINDDUN, CIA, DIE, and PLOT4ai methodologies, auto-generates threats via a rule engine, and runs as a web app or desktop app with GitHub, Bitbucket, and GitLab integration.

Use cases

• draw threat model data flow diagrams
• create STRIDE threat models for a system
• record threats and mitigations during secure development lifecycle
• model threats for a microservices architecture
• collaboratively store threat models in GitHub or GitLab
• auto-generate threats from diagram elements
• teach threat modeling to a development team

When to choose

• you need a free, open-source threat modeling tool with diagramming
• your team follows STRIDE, LINDDUN, CIA, DIE, or PLOT4ai methodologies
• you want threat models stored in git-based repositories
• you need both web and desktop versions

When to avoid

• you need automated scanning of live infrastructure rather than manual modeling
• you require commercial support or enterprise compliance certifications
• you need deep integration with proprietary ticketing or GRC platforms

Facets

application · maturity active

security gui editor security developer-tools web-development cross-platform windows self-hosted threat-modeling stride linddun data-flow-diagram owasp sdlc risk-assessment web-server desktop linux macos

Member repositories

For agents

markdown · JSON · MCP: product_card(name="OWASP/threat-dragon")