Strategy for decoupling models, rules from runtime
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 1.2k
- Forks
- 229
- PR merge metrics
- No merged PRs in 30d
Description
While one of pytm biggest strength is the "threat model as code" concept atm it's not easily possible to decouple customer specific rules, model libs, etc. from the pytm "runtime" (report generation, diagram generation). This topic relates to https://github.com/OWASP/pytm/issues/295#issuecomment-3399078011 and https://github.com/OWASP/pytm/issues/19 as well potentially. E.g. ideally all the "models as code" could be handled separately from the pytm CLI application capabilities. This would significantly simplify enable people to integrate pytm into CI workflows as well as to scale pytm usage in general.
@izar What are your longer term goals related to this topic?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reading the discussion linked from issue 295 and issue 19, then examine how pytm’s CLI, report generation, diagram generation, models, and rules are currently related. Done would be an agreed strategy for separating customer-specific threat models and rules from the runtime while preserving a clear path for CI integration.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- cli, security
- Issue type
- Refactor
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100