ThreatSea

ThreatSea is a threat modeling tool developed by MaibornWolff GmbH, which implements the 4x6 methodology. It provides a comprehensive framework for identifying and analyzing potential threats in software systems, helping organizations to implement effective security measures.

Getting started

Requirements

• node.js installation (you can find the currently used version of node.js in the .node-version file)
• pnpm package manager
• PostgreSQL database

# Install dependencies
$ pnpm i
# Run ThreatSea locally in dev mode (in default configuration it will be served at http://localhost:3000)
$ pnpm run dev

E2E Testing (Playwright)

ThreatSea uses Playwright for end-to-end testing. The test suite is located under apps/frontend/playwright/ and follows the Page Object Model (POM) pattern.

Setup

Run the init script once to ensure Playwright browsers are installed on your machine:

cd apps/frontend
pnpm run playwright:init

Make sure the following are running before executing tests:

• Database: docker compose up -d postgres
• Backend: pnpm dev --filter=threatsea_be
• Frontend: started automatically by Playwright if not already running

Run Tests

cd apps/frontend

# Run all E2E tests (Chromium, 1 worker — recommended locally)
pnpm run playwright

# Open Playwright UI Mode (interactive, with time-travel debugging)
pnpm run playwright:ui

After a test run, the HTML report is available at apps/frontend/playwright-report/index.html.

Playwright UI Mode

Playwright UI Mode provides a time travel testing experience with watch mode, test file exploration, filtering, detailed test traces, and DOM snapshot debugging. More information in Playwright's documentation.

---

Get Involved

Do you have a bug or feature request? Please open a new issue. For any questions on how to use ThreatSea, please consult the documentation or join the discussion. Feedback is always welcome.

Contributing

Please see the Contributing Guidelines for more information on how to get involved in the project.

Releases

ThreatSea uses semantic-release for automated versioning and releases. Releases are automatically created when changes are pushed to the main branch, following Conventional Commits specification.

Release Process

1. Automatic Releases: When code is pushed to main branch, the CI pipeline will:

   • Run all tests and quality checks
   • Analyze commit messages to determine the next version number
   • Create a GitHub release with release notes
   • Build and publish Docker container images to GitHub Container Registry

2. Container Images: The following Docker images are published:

   • maibornwolff/threatsea:{ latest | release version } - published on Docker Hub
   • ghcr.io/maibornwolff/threatsea:{ latest | next | (pre-)release version } - published on GitHub Container Registry (includes prerelease versions)

3. Versioning: Version numbers follow Semantic Versioning:

   • feat: commits trigger a minor version bump
   • fix:, perf:, revert: commits trigger a patch version bump
   • Commits with BREAKING CHANGE in the footer trigger a major version bump

Commit Message Format

Please use Conventional Commits format for your commit messages:

<type>[optional scope]: <description>

[optional body]

[optional footer(s)]

Examples:

• feat: add new threat analysis feature
• fix: resolve authentication issue
• docs: update installation guide

Code of Conduct

Please note that this project is released with a Code of Conduct. By participating in this project you agree to abide by its terms.

License

ThreatSea is licensed under the BSD-3-Clause License

---

Made with ❤ by MaibornWolff GmbH  ·  GitHub @MaibornWolff