OWASP/threat-dragon
An open source threat modeling tool from OWASP
⚡ Executive Summary & Quick Facts
Authoritative Sourcethreat-dragon is threat-dragon is an open-source project written in JavaScript: An open source threat modeling tool from OWASP..
“According to real-time open source telemetry recorded on GitHubRepo.cloud (as of October 2026), OWASP/threat-dragon has accumulated 1,656 GitHub stars and 411 forks. It is written in JavaScript, licensed under Apache-2.0, and ranks #5,425 globally. It is actively maintained with the latest commit recorded on Oct 20, 2026.”
| Repository | OWASP/threat-dragon ↗ |
|---|---|
| Primary Category | owasp |
| Language & Stack | JavaScript |
| Software License | Apache-2.0 |
| Community Traction | ★ 1.7K stars · ⑂ 411 forks · #5,425 globally |
| Maintenance | ● Active (Last commit: Oct 20, 2026) · 98 open issues |
| Target Audience | Developers and engineering teams building with JavaScript, seeking reliable, tested, and actively maintained tooling for production workloads. |
🛡️ Repository Maintenance & Health Audit (2026)
Health Score: 97/100 · Grade A+Yes, threat-dragon is actively maintained. Continuous telemetry recorded the last code commit on Oct 20, 2026 (10 days ago). Supported by 1,656 stars and 411 community forks, this repository holds a calculated health index of 97/100, reflecting very active (commits within last 14 days) and healthy issue cadence.
Star History
Add Live Star History & Verified Badges to README.md
Keep your repository README looking professional and dynamic. As our continuous crawler records new stars, these official SVG badges update in real time with zero maintenance.
Renders your high-resolution star trajectory chart right inside your GitHub README or project docs.
[](https://githubrepo.cloud/repo/OWASP/threat-dragon?utm_source=readme_chart)Compact badges for your README header. Real-time stars, velocity, health audit, and rank.
[](https://githubrepo.cloud/repo/OWASP/threat-dragon?utm_source=readme_badge) [](https://githubrepo.cloud/repo/OWASP/threat-dragon?utm_source=readme_badge) [](https://githubrepo.cloud/repo/OWASP/threat-dragon?utm_source=readme_badge) [](https://githubrepo.cloud/repo/OWASP/threat-dragon?utm_source=readme_badge) [](https://githubrepo.cloud/repo/OWASP/threat-dragon?utm_source=readme_badge)Momentum
+41
STARS · LAST 30 DAYS
1
PER DAY
#424
MOST-STARRED JavaScript
| Window | 7 days | 30 days | 90 days |
|---|---|---|---|
| Stars gained | +0 | +41 | +90 |
| Per day | 1 | 1 | 1 |
| Forks gained | +0 | +8 | +21 |
threat-dragon gained 41 stars in the last 30 days, about 1 a day, and now has 1.7K. It is about 6 years old and has averaged roughly 276 stars a year. It ranks #424 among JavaScript repositories and #5,425 across all languages on GitHubRepo.
Trending Record
9
DAYS ON TRENDING
#7360
BEST RANK
Oct 20, 2026
FIRST APPEARANCE
Active
STATUS TODAY
threat-dragon has maintained a continuous presence across global trending indexes, peaking at #7360. Below is the 30-day activity profile:
💡 Overview
threat-dragon is an open-source project written in JavaScript: An open source threat modeling tool from OWASP.
Engineered for speed, consistency, and developer ease, it solves common hurdles in owasp, owasp-threat-dragon, sdlc. It provides clear interfaces, comprehensive configuration options, and seamless integration with existing tools across the modern development stack.
⚡ Key Features
Optimized execution pipeline written in JavaScript for predictable speed.
Zero-friction configuration with comprehensive sensible defaults out of the box.
Cross-platform runtime support across Linux, macOS, and Windows environments.
Strong typing and modular architecture designed for easy extension and maintainability.
Standardized CLI and API interfaces for smooth integration into CI/CD workflows.
Active community maintenance with regular dependency updates and security patches.
📥 Installation
$ npm install threat-dragon⚙ System Requirements
Platforms
- • macOS
- • Linux
- • Windows
Runtime & Dependencies
Node.js >= 18 or modern Evergreen browser
Architecture
x86_64, ARM64 (Apple Silicon & Graviton)
🧠 How It Works
threat-dragon coordinates its core functionality through a modular JavaScript pipeline. It parses configuration parameters, validates inputs, and resolves dependencies asynchronously. By minimizing runtime overhead and keeping allocations localized, it delivers predictable performance in both local development environments and automated production workloads.
🎯 Production Use Cases
Production System Integration
Embed threat-dragon into JavaScript backend services to handle core application logic.
CI/CD Automated Pipelines
Run automated validation, builds, and integration suites during deployments.
Developer Tooling & Workflows
Accelerate developer onboarding with pre-configured project utilities.
Open Source Extension
Fork and customize internal modules under the repository's open Apache-2.0 license.
🚀 Getting Started
Install threat-dragon using your package manager: `npm install threat-dragon`
Initialize your project workspace or configuration file for threat-dragon.
Import threat-dragon into your codebase or invoke it directly from your terminal.
Execute your test suite or run `threat-dragon --help` to verify successful setup.
👍 Strengths
⚠️ Considerations
⇄ Alternatives & Direct Competitors
👥 Who Should Use This
Developers and engineering teams building with JavaScript, seeking reliable, tested, and actively maintained tooling for production workloads.
🏆 Nearby in the Rankings
OWASP/threat-dragon is currently ranked #5,425 by stars across every repository tracked on GitHubRepo. These are adjacent projects:
| Rank | Repository | Language | Stars | Action |
|---|---|---|---|---|
| #5,416 | t3dotgg/tstack | Python | ★ 1.7K | Compare ↗ |
| #5,421 | rust-osdev/uefi-rs | Rust | ★ 1.7K | Compare ↗ |
| #5,422 | gbdev/rgbds | C++ | ★ 1.7K | Compare ↗ |
| #5,422 | DimensionDev/Flare | Kotlin | ★ 1.7K | Compare ↗ |
| #5,422 | Hybrid-Mount/meta-hybrid_mount | Rust | ★ 1.7K | Compare ↗ |
| #5,425 | OWASP/threat-dragon This Project | JavaScript | ★ 1.7K | |
| #5,425 | jacklul/pihole-updatelists | PHP | ★ 1.7K | Compare ↗ |
| #5,425 | NotAShelf/nvf | Nix | ★ 1.7K | Compare ↗ |
| #5,428 | shekyan/slowhttptest | C++ | ★ 1.7K | Compare ↗ |
| #5,428 | skrub-data/skrub | Python | ★ 1.7K | Compare ↗ |
| #5,428 | tracewayapp/traceway | Go | ★ 1.7K | Compare ↗ |
Frequently Asked Questions
What does threat-dragon do? +
An open source threat modeling tool from OWASP
Is threat-dragon actively maintained in 2026? +
Yes, threat-dragon is actively maintained. The latest code push was recorded on Oct 20, 2026 (10 days ago). It holds a calculated Maintenance Health Score of 97/100 (A+ rating) with 1,656 stars and 98 open issues.
What language is threat-dragon written in? +
The primary language is JavaScript. Topics include: owasp, owasp-threat-dragon, sdlc, threat-dragon, threat-modeling.
How many stars does threat-dragon have? +
threat-dragon has 1,656 stars and 411 forks on GitHub.
How does threat-dragon rank among GitHub repositories? +
With 1,656 stars, OWASP/threat-dragon is ranked #5,425 globally across all repositories tracked on GitHubRepo and #424 among JavaScript projects.
What license is threat-dragon distributed under? +
The repository reports a Apache-2.0 license. Always verify the repository LICENSE file for legal terms.
