OWASP/pytm

View on GitHub

A Pythonic framework for threat modeling

Stars: 1.2k
Forks: 229
Open beginner issues: 0
Indexed issues: 36

Dominant language: Python
License: No license data
Last GitHub push: Aug 19, 2026
Latest indexed: Sep 19, 2026
Contributing guide: Contributing guide
Code of conduct: No code of conduct
Beginner labels: hacktoberfest help wanted good first issue
PR merge metrics: No merged PRs in 30d

Beginner friendly Everything

Open All

36 open issues indexed

Care about missing SetOfProcess business logic Open

Difficulty 5/5 Over a week Newbie friendliness 35/100

OWASP/pytm#363 · 3 comments · Opened Aug 17, 2026
Docs: Replace pdoc3 with Zensical, provide a project + API documentation Open

Difficulty 5/5 Over a week Newbie friendliness 35/100

OWASP/pytm#352 · Opened Aug 14, 2026
Docs: Add hint about (upcoming) CycloneDX TMBOM (Threat Model Bill of Materials) support Open

Difficulty 2/5 1-3 hours Newbie friendliness 58/100

OWASP/pytm#351 · 1 comment · Opened Aug 14, 2026
Docs: Hint about outdated docs Open

Difficulty 3/5 1-2 days Newbie friendliness 30/100

OWASP/pytm#334 · 1 reaction · Opened Jun 5, 2026
Consider using python objects for defining threats Open

Difficulty 5/5 Over a week Newbie friendliness 35/100

OWASP/pytm#327 · 8 comments · Opened Apr 20, 2026
Devbox build issue on Mac | Build Fails Open

Difficulty 2/5 1-3 hours Newbie friendliness 48/100

OWASP/pytm#315 · 5 comments · Opened Feb 18, 2026
Docs: Autogenerate threats into docs Open

Difficulty 4/5 3-5 days Newbie friendliness 48/100

OWASP/pytm#304 · 10 comments · Opened Nov 19, 2025
GitHub milestones? Open

Difficulty 5/5 Over a week Newbie friendliness 35/100

OWASP/pytm#303 · 10 comments · Opened Nov 19, 2025
Strategy for decoupling models, rules from runtime Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

OWASP/pytm#302 · 4 comments · Opened Nov 19, 2025
Add docstrings for pytm model entities Open

Difficulty 3/5 1-2 days Newbie friendliness 68/100

OWASP/pytm#294 · 6 comments · Opened Oct 13, 2025
add ruff to gh workflows Open

Difficulty 2/5 1-3 hours Newbie friendliness 35/100

OWASP/pytm#292 · Opened Oct 12, 2025
Docs: Autogeneration of pytm model into docs Open

Difficulty 4/5 3-5 days Newbie friendliness 35/100

OWASP/pytm#279 · 2 comments · Opened Oct 8, 2025
Support ">" in Boundaries Open

Difficulty 3/5 1-2 days Newbie friendliness 52/100

OWASP/pytm#278 · 1 reaction · Opened Oct 7, 2025
Nested trust boundaries Open

Difficulty 4/5 3-5 days Newbie friendliness 32/100

OWASP/pytm#271 · 3 comments · Opened Jul 9, 2025
Apply same threat to multiple assets Open

Difficulty 4/5 3-5 days Newbie friendliness 25/100

OWASP/pytm#267 · 3 comments · Opened Mar 11, 2025
Applying custom threats only to specific elements. Open

Difficulty 4/5 3-5 days Newbie friendliness 25/100

OWASP/pytm#262 · 1 comment · Opened Feb 18, 2025
Guidance or examples on Classification Open

Difficulty 4/5 3-5 days Newbie friendliness 25/100

OWASP/pytm#260 · 6 comments · Opened Dec 17, 2024
Format: "png" not recognized. Open

Difficulty 2/5 1-3 hours Newbie friendliness 42/100

OWASP/pytm#254 · 1 comment · Opened Nov 2, 2024
AC22 Credential Aging review Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

OWASP/pytm#239 · 5 comments · Opened Apr 1, 2024
Alternative format for threat lib for better readability and editing Open

Difficulty 5/5 Over a week Newbie friendliness 32/100

OWASP/pytm#237 · 6 comments · 1 reaction · Opened Mar 29, 2024
Suggest to support converting c4 models into pytm Open

enhancement

Difficulty 5/5 Over a week Newbie friendliness 35/100

OWASP/pytm#212 · 14 comments · 3 reactions · Opened Mar 13, 2023
Threat Evaluation Improvements: Simplify conditions and first step toward detecting mitigations Open

Difficulty 5/5 Over a week Newbie friendliness 20/100

OWASP/pytm#152 · 12 comments · Opened Apr 5, 2021
Are container objects missing? Open

enhancement

OWASP/pytm#113 · 13 comments · 1 assignee · Opened Sep 26, 2020
Objects should be generic, with roles Open

enhancement

Difficulty 5/5 Over a week Newbie friendliness 25/100

OWASP/pytm#112 · 5 comments · 1 reaction · Opened Sep 26, 2020
DataFlow object attributes need work (or moves) Open

enhancement

Difficulty 5/5 Over a week Newbie friendliness 20/100

OWASP/pytm#111 · 16 comments · Opened Sep 26, 2020
AC03 - condition is too limiting Open

enhancement Hacktoberfest help wanted

Difficulty 5/5 Over a week Newbie friendliness 25/100

OWASP/pytm#34 · 1 comment · Opened Oct 21, 2018
DO01 - wrong condition check? Open

enhancement Hacktoberfest help wanted

Difficulty 5/5 Over a week Newbie friendliness 20/100

OWASP/pytm#32 · 1 comment · Opened Oct 21, 2018
DE01 Data Flow Sniffing vs DE02 Weak Credential Transit Open

Difficulty 5/5 Over a week Newbie friendliness 20/100

OWASP/pytm#29 · 4 comments · Opened Oct 21, 2018
Missing documentation for conditions Open

Hacktoberfest help wanted

Difficulty 4/5 3-5 days Newbie friendliness 25/100

OWASP/pytm#28 · 5 comments · Opened Oct 21, 2018
DS01: Weak credential storage - condition too broad Open

good first issue Hacktoberfest

Difficulty 3/5 1-2 days Newbie friendliness 35/100

OWASP/pytm#27 · 1 comment · Opened Oct 21, 2018
Automatic trust boundary detection? Open

enhancement Hacktoberfest help wanted

Difficulty 5/5 Over a week Newbie friendliness 20/100

OWASP/pytm#23 · 2 comments · Opened Aug 10, 2018
Logic is going to get messy fast, rules engine? Open

Hacktoberfest help wanted

Difficulty 5/5 Over a week Newbie friendliness 25/100

OWASP/pytm#19 · 18 comments · 1 reaction · Opened Jul 20, 2018
Add Exclusion logic for Threats? Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

OWASP/pytm#14 · 2 comments · Opened Jul 19, 2018
Initial TM creation is a pain and requires a lot of typing Open

good first issue Hacktoberfest

Difficulty 4/5 3-5 days Newbie friendliness 35/100

OWASP/pytm#12 · 9 comments · Opened Jul 19, 2018
DF1 threat assumes source and sink are remote systems Open

good first issue Hacktoberfest help wanted

Difficulty 5/5 Over a week Newbie friendliness 25/100

OWASP/pytm#9 · 7 comments · Opened Jul 19, 2018
Proposal: isHardened should not be a property on its own Open

enhancement

OWASP/pytm#1 · 14 comments · 1 assignee · Opened May 25, 2018

OWASP/pytm

Get new issues in your inbox