v0.5.0 Release Notes¶

Release Date: 2026-04-19

This release introduces design-time threat modeling capabilities for proactive security analysis during the SDLC.

Highlights¶

Design-time threat modeling for proactive security analysis during SDLC
Structured risk assessment with likelihood × impact scoring (1-5 scales)
Asset inventory with sensitivity classification and compliance mapping
What-if scenario modeling for attack path analysis
Network topology mapping for infrastructure diagrams

What's New¶

Design-Time Threat Modeling¶

New capabilities for proactive threat modeling before features are built:

Feature	Description
`ModelPhase`	SDLC phase tracking (design, development, review, production, incident)
`ThreatStatus`	Extended with `potential` and `theoretical` for hypothetical threats
Guides	Comprehensive guides for design-time threat modeling workflow

Use phase: "design" to indicate threat models created during the design phase:

{
  "id": "feature-oauth",
  "title": "OAuth2 Implementation",
  "phase": "design",
  "description": "Threat model for planned OAuth2 feature"
}

Risk Assessment¶

Structured risk scoring with likelihood × impact:

{
  "risk": {
    "likelihood": 4,
    "impact": 5,
    "likelihoodRationale": "Public API with known vulnerability pattern",
    "impactRationale": "Full access to user PII if exploited"
  }
}

Risk Level	Score Range	Action
Critical	20-25	Immediate action required
High	15-19	Address before release
Medium	8-14	Plan mitigation
Low	4-7	Monitor and review
Info	1-3	Accept or document

Asset Inventory¶

Document assets being protected with sensitivity classification:

{
  "assets": [
    {
      "id": "asset-userdb",
      "name": "User Database",
      "type": "data",
      "classification": "restricted",
      "dataTypes": ["PII", "credentials"],
      "complianceFrameworks": ["GDPR", "SOC2"]
    }
  ]
}

Sensitivity levels: public, internal, confidential, restricted, secret

Scenario Modeling¶

Model what-if attack scenarios:

{
  "scenarios": [
    {
      "id": "scenario-1",
      "title": "External Attacker Compromises API",
      "type": "external-attack",
      "preconditions": ["API has authentication bypass"],
      "attackPath": ["Reconnaissance", "Exploit auth", "Access data"],
      "outcome": "Unauthorized access to user PII",
      "businessImpact": "GDPR fines, reputation damage"
    }
  ]
}

Scenario types: external-attack, insider-threat, supply-chain, social-engineering, data-breach, ransomware, zero-day

Network Topology Mapping¶

Map elements to network infrastructure:

{
  "elements": [
    {
      "id": "api-server",
      "label": "API Server",
      "type": "process",
      "network": {
        "host": "api.example.com",
        "ports": [443],
        "protocols": ["HTTPS", "gRPC"],
        "zone": "dmz",
        "cloud": {
          "provider": "aws",
          "region": "us-east-1",
          "vpc": "vpc-production"
        }
      }
    }
  ]
}

Extended ThreatEntry¶

Threats can now include:

risk — Structured risk assessment
linddunCategory — LINDDUN privacy threat category
affectedAssets — Asset IDs affected by this threat
attackVector — Description of the attack vector
preconditions — Conditions required for the threat

New Types¶

Type	Description
`RiskAssessment`	Likelihood × impact scoring with rationale
`RiskLevel`	Categorical risk levels (critical/high/medium/low/info)
`ModelPhase`	SDLC phase (design/development/review/production/incident)
`Asset`	Protected asset with classification and compliance mapping
`AssetType`	Asset type (data/service/infrastructure/credential/key/code)
`SensitivityLevel`	Data classification (public/internal/confidential/restricted/secret)
`Scenario`	What-if attack scenario with attack path
`ScenarioType`	Scenario category (external-attack/insider-threat/etc.)
`NetworkInfo`	Network topology (host, ports, protocols, zone)
`CloudInfo`	Cloud provider details (provider, region, vpc, subnet)

Documentation¶

New guides added to the MkDocs documentation:

Design-Time Threat Modeling Guide — Proactive SDLC integration
Risk Assessment Guide — Likelihood/impact scoring methodology

Installation¶

Go Library¶

go get github.com/grokify/threat-model-spec@v0.5.0

CLI Tool¶

go install github.com/grokify/threat-model-spec/cmd/tms@v0.5.0

Requirements¶

Go 1.24+
D2 v0.6+ (for SVG rendering)