Skip to content
Switch branches/tags


Failed to load latest commit information.

Threat Dragon Logo

Build BrowserStack Status Deploy GitHub license Language grade: JavaScript Trivy Scan

OWASP Threat Dragon

OWASP Threat Dragon is a free, open-source, cross-platform threat modeling application. It is used to draw threat modeling diagrams and to list threats for elements in the diagram.

Threat Dragon is designed to be accessible for various types of teams, with an emphasis on flexibility and simplicity. It is an OWASP Lab Project and follows the values and principles of the threat modeling manifesto.

Check it out

Try the Threat Dragon version 2.0 snapshot on our website, or watch the video provided by the OWASP Spotlight series.

About Threat Dragon

There is a good overview of threat modeling and risk assessment from OWASP, and this expands on what the Threat Dragon project aims for:

  • ease of use and accessible
  • designing a data flow diagram
  • suggesting threats
  • entering mitigations and counter measures

Mike Goodwin is the founder and creator of this project, and this repository has been migrated from Mike Goodwin's original which has the issues and pull requests from October 2015 up to June 2020. Since then the project team has continued development, culminating with release version 1.6.0. The project is now going through a substantial changes which will see version 2.0 released early 2022.

Threat Dragon is primarily a web application, with threat model files stored in GitHub. Over time other storage methods will become available.

There is also a desktop version of Threat Dragon which stores the threat model files on the local filesystem rather than in a repository. Each release provides installers for Windows, Mac OSX and Linux.

End user help is available for both variants.

Version 2.0 Development

After many years using AngularJS and JointJS, Threat Dragon is migrating development to Vue and antv/g6 drawing library. This version will be ready later in 2022, until then use the latest version of Threat Dragon 1.x.

Version 1.x Maintenance mode

Threat Dragon was originally written using AngularJS version 1.x, which is reaching end of life. All versions 1.x are using the AngularJS implementation. Future versions (2.x+) are using Vue.js. The main branch is now for version 2.x+, which is currently unreleased. For more information on building/running version 1.x, please see the legacy-v1.x branch.

Installing version 2.x

Install git and node.js (version 16)

  • which includes the node package manager npm - and then Install pnpm

To get the code navigate to a target directory and use command

git clone

This downloads the code into a threat-dragon directory and the application code is in two sub-folders, one for the back-end application (td.server) and one for the front-end (td.vue).

PNPM (rather than NPM) is used to install from the top directory of the project : pnpm install

Environment variables

Threat Dragon uses GitHub to store threat models, so you need to go to your GitHub account and register it as a GitHub application. There is a step by step guide on how to do this.

You will also have to provide other environment variables, again following the documentation on this.

If running Threat Dragon locally then the front-end to server communication will probably need to be HTTP rather than HTTPS. Specify this using environment variable SERVER_API_PROTOCOL=http in the dotenv file or the command line.

Run the application

When running on Windows, and during development, the front-end and back-end can be started separately in "watch" mode using commands : npm run dev:server and npm run dev:vue. Alternatively, if running on Linux or MacOS, start both the back-end server and the front-end application from the top directory using : npm start.

With both front and back end running, access with a browser at http://localhost:8080/

Stop the application

If using npm start, stop both the back-end server and the front-end application from the top directory: npm stop. Otherwise break out of both the server and vue front-end.

Docker (local build)

To run Threat Dragon in a docker container, first configure your environment using dotenv and run from the top directory of the project:

  • docker build -t owasp-threat-dragon:dev .
  • docker run -it --rm -p 8080:3000 -v $(pwd)/.env:/app/.env owasp-threat-dragon:dev

Using http port 8080 and accessing Threat Dragon on http://localhost:8080/.

Docker (from dockerhub)

Threat Dragon maintains a docker image on Dockerhub. Each release is tagged as v{major}.{minor}.{patch}, eg v1.6.0

Do not use the latest tag (which is the default), as it could be a development release

Alternatively, you can use the stable tag, which will always be the latest official release.

  • docker pull threatdragon/owasp-threat-dragon:stable
  • docker run -it --rm -p 8080:3000 -v $(pwd)/.env:/app/.env threatdragon/owasp-threat-dragon:stable

Assuming that you are using http port 8080 and accessing Threat Dragon on http://localhost:8080/.


Pull requests, feature requests, bug reports and feedback of any kind are very welcome, please refer to the page for contributors.

There are some developer notes to help get started with this project. We are trying to keep the test coverage relatively high, so please try to update tests in any pull requests and create these pull requests off the V2 development main branch.

Vulnerability disclosure

If you find a vulnerability in this project please let us know ASAP and we will fix it as a priority. For secure disclosure, please see the security policy.

Project leaders