Skip to main content
← back to extensions

Threat Model

@webframp/threat-modelv2026.08.28.1· 14d agoMODELS
01README

Agile threat modeling as an agent-guided concept model. Guides structured threat assessment through progressive discovery: scope, identify, evaluate, mitigate, posture. Stores versioned threat models with automatic risk matrix computation, control coverage tracking, and a compact posture snapshot for monitoring.

Follows the discipline's methodology: identify threats, assess likelihood × impact, define compensating controls, and track residual risk through mitigated/accepted/deferred/unaddressed status per scenario.

02Release Notes

2026.08.28.1

Changed: Normalized the extension license to Apache-2.0 and corrected the copyright holder to "Sean Escriva". Extensions that previously shipped an MIT LICENSE.md are now Apache-2.0, consistent with the repository root and every other extension. No code or behavioral changes.

Upgrade note: License text only. No API, schema, or runtime behavior changed.

2026.08.26.3

Fixed: Restored inline npm:zod@4.4.3 import specifiers so the registry quality scorer can resolve dependencies and score the extension. An earlier release used a bare "zod" import-map specifier, which published but scored as unscored.

Changed: Retained explicit compilerOptions.strict in deno.json. No behavioral or schema changes.

03Models1
@webframp/threat-modelv2026.08.28.1threat-model/mod.ts

Global Arguments

ArgumentTypeDescription
likelihoodScalestringDefinition of likelihood levels for consistent scoring
impactScalestringDefinition of impact levels for consistent scoring
mitigationFrameworkstringReference framework for control selection (CWE, NIST, OWASP, custom)
fn scope(subject: string, scope: string, currentPosture: string, assets: array)
Define the threat assessment scope and establish context. AGENT GUIDANCE: 1. Ask: "What system, feature, or change are we assessing?" Get a one-sentence subject and a paragraph of current security posture. 2. Ask: "What assets are at stake? List the key properties — credential types, data classifications, integration points, trust boundaries." Record as name/value pairs. 3. Ask: "What is the assessment date and any relevant context about timing (e.g., pre-deployment, post-inciden
ArgumentTypeDescription
subjectstringWhat is being assessed (system, feature, change)
scopestringBoundary statement: what is/is not included
currentPosturestringCurrent security posture before this change
assetsarrayKey assets at stake (credential types, data, integrations)
fn identify(threats: array)
Identify threat scenarios through structured conversation. AGENT GUIDANCE: 1. Read the current assessment resource to understand scope and assets. 2. For each asset/trust boundary, guide discovery: - "Who might attack this? What is their motivation?" - "What could go wrong if this is compromised?" - "What is the attack chain — what steps does exploitation require?" 3. For each threat scenario, capture: - A short ID (T1, T2, ...) - Title (one line) - Description (what could
ArgumentTypeDescription
threatsarray
fn evaluate(openQuestions: array, adjustments: array)
Produce the risk matrix and add open questions. AGENT GUIDANCE: 1. Read the current assessment to review identified threats. 2. Present the risk matrix (likelihood × impact → risk level) to the user. Discuss whether any scenarios need re-scoring based on new information. 3. Identify open questions — things that would change the assessment if answered: - Undocumented behaviors - Vendor dependencies - Propagation delays - Missing telemetry 4. Call this method to record open que
ArgumentTypeDescription
openQuestionsarray
adjustmentsarrayOptional re-scoring of threats based on discussion
fn mitigate(controls: array, acceptances: array, deferred: array, recommendation: string)
Define compensating controls and produce recommendation. AGENT GUIDANCE: 1. Read the current assessment and its threat scenarios. 2. For each threat (or cluster of related threats), guide control definition: - "What compensating control reduces this risk?" - "Does it fully mitigate, partially reduce, or minimally address the threat?" - "Is it already implemented or proposed?" Reference the configured mitigationFramework (globalArgs) for principles. 3. For threats where no control
ArgumentTypeDescription
controlsarray
acceptancesarray
deferredarrayThreat IDs to mark as deferred
recommendationstring
fn posture()
Compute and write a compact risk posture snapshot. Reads the current
fn revisit(changesNoted: array)
Review an existing threat model against system changes. AGENT GUIDANCE: 1. Read both the assessment and posture resources. Present the current state. 2. Ask: "What has changed since this was last assessed? Consider: - New integrations, APIs, or dependencies added - Configuration changes (features enabled/disabled) - Incidents that revealed new attack surface - Controls that have been implemented since last review - Open questions that now have answers" 3. For each change, dete
ArgumentTypeDescription
changesNotedarraySummary of changes identified during review discussion

Resources

assessment(infinite)— Full threat model state: scope, threats, controls, acceptances, recommendation
posture(infinite)— Compact risk posture snapshot. Derived from assessment; safe for periodic monitoring.
04Previous Versions11
2026.08.26.3

2026.08.26.3

Fixed: Restored inline npm:zod@4.4.3 import specifiers so the registry quality scorer can resolve dependencies and score the extension. An earlier release used a bare "zod" import-map specifier, which published but scored as unscored.

Changed: Retained explicit compilerOptions.strict in deno.json. No behavioral or schema changes.

2026.08.26.1

2026.08.26.1

Fixed: Added missing description field to upgrade entry for version 2026.08.24.2. The omission caused swamp extension pull to fail with a catalog validation error ("upgrades.N.description: Invalid input: expected string, received undefined").

2026.08.24.3

2026.08.24.3

Added: Output metadata attributes for observability.

  • durationMs: Method execution duration in milliseconds.
  • collectedBy: Extension name that produced the data.
  • fetchedAt: ISO 8601 timestamp when data was fetched (added to resources that previously lacked it).
2026.08.24.2

2026.08.24.2

Added Troubleshooting section documenting strict method ordering, threat ID validation, hardcoded risk matrix, and read-only revisit method.

2026.08.21.2

2026.08.21.2

Changed: evaluate and mitigate now validate that the threat IDs they reference actually exist in the current assessment before applying any change. Previously, calling evaluate with an adjustment for a typo'd or stale threatId, or calling mitigate with a control's mitigates list, an acceptance's threatId, or a deferred entry pointing at a threat ID that was never identified, silently did nothing — the assessment was written back unchanged with no indication that the reference didn't resolve. Both methods now throw a descriptive error listing the unknown ID(s) and the known IDs on the assessment, so a typo surfaces immediately instead of producing a posture snapshot that quietly omits the intended change.

2026.08.21.1

2026.08.21.1

Changed: Added .describe() to previously undocumented fields on the AssetSchema, ThreatScenarioSchema, ControlSchema, AcceptanceSchema, AssessmentSchema, and PostureSchema resource schemas (e.g. title, description, effectiveness, acceptedBy, byStatus, byRiskLevel, unmitigatedAboveThreshold). No behavioral change.

2026.07.18.1

Added: An upgrades array entry (no-op) to mod.ts for proper typeVersion tracking on existing instances. No schema or behavior changes.

2026.07.18.1

2026.07.18.1

Added: An upgrades array entry (no-op) to mod.ts for proper typeVersion tracking on existing instances. No schema or behavior changes.

2026.06.21.1
2026.06.15.1
2026.06.09.2
2026.06.09.1
05Stats
A
100 / 100
Downloads
3
Archive size
22.4 KB
  • Has README or module doc2/2earned
  • README has a code example1/1earned
  • README is substantive1/1earned
  • Most symbols documented1/1earned
  • No slow types (deprecated)1/1earned
  • Dependencies pass trust audit2/2earned
  • Has description1/1earned
  • Platform support declared (or universal)2/2earned
  • License declared1/1earned
  • Verified public repository2/2earned
Repository
https://github.com/webframp/swamp-extensions
06Platforms
07Labels
#security#threat-modeling#risk-assessment#devsecops