The keys are stored as a JSON string in the SESSION_ENCRYPTION_KEYS environment variable. Once all sessions are using the new primary key (typically this will be around 60 minutes maximum), the old one can be safely removed. Retired keys can be kept available for decrypting existing sessions. The primary key is always used for encryption. The session encryption supports multiple keys so that they can be expired without any interruption to the running application. For security, this is encrypted before storage in the session. Once a user is signed in, their session information contains an OAuth access token with write access to their GitHub repos. You also need to set a session signing key environment variable ( SESSION_SIGNING_KEY). Once you have done that you need to set the Client ID and Client Secret as environment variables ( GITHUB_CLIENT_ID and GITHUB_CLIENT_SECRET). Threat Dragon uses GitHub to store threat models, so you need to go to your GitHub account and register it as a GitHub application. One for the main application ( td) and one for the unit tests ( td.tests). To get the code, navigate to where you want your code to be located and do Install git and node.js - which includes the node package manager npm. To build and run locally follow these steps: Threat Dragon is a Single Page Application (SPA) using Angular on the client and node.js on the server. This repository contains the files for the web application variant.Ĭore files that are shared between both the desktop and web variants are stored in an seperate repo and are installable as a seperate package. Note that for the desktop variant the models are stored on the local filesystem rather than a remote repository.Įnd user help is available for both variants. There are installers available for both Windows and Mac OSX, as well as rpm and debian packages for Linux. We are currently maintaining a working protoype in synch with the master code branch.Ī desktop application: This is based on Electron. The focus of the project is on great UX, a powerful rule engine and integration with other development lifecycle tools.Ī web application (this repo): For the web application, models files are stored in GitHub (other storage will become available). Threat Dragon is a free, open-source, cross-platform threat modelling application including system diagramming and a threat rule engine to auto-generate threats/mitigations.

Sdl threat modeling tool built by