Skip to content
AttackCanvas
Threat modeling for public repositories

See how your code could be attacked, and why.

Paste a public GitHub repository. AttackCanvas maps its architecture, raises STRIDE threats tied to OWASP Top 10:2025 and CWE, and shows the evidence and the confidence behind every one.

Start an analysis

The repository must be public. Nothing is written to it, and secrets found in it are never sent to a model.

Analysis level

Balanced depth; a good default.

Costs are API usage estimates; larger repositories cost more.

IllustrationExample shapes only. Your repository's real diagram appears after its analysis runs.
How it works

Evidence first, model second

  1. 01

    Read, never run

    The repository is loaded read-only. Files are filtered, and secrets are redacted before anything reaches a model.

  2. 02

    Scan with deterministic tools

    Detectors, Semgrep and OSV dependency checks find concrete evidence and missing controls.

  3. 03

    Model the architecture

    Components, data flows and trust boundaries are mapped, then STRIDE threats are raised per element.

  4. 04

    Score with rules, not guesses

    Severity, confidence and priority come from fixed scoring rules. Anything uncertain is labelled as such.

Roadmap

Coming soon

  • Incremental scans

    The first scan reads the whole repository; later scans re-check only changed files and components.

  • Full scan or change scan

    The user picks a complete analysis or a cheaper review of what changed.

  • Scans triggered by Git activity

    Automatic scans on merge to main, with optional scans per commit and per pull request.

  • Targeted branch scans

    Scans of non-main branches only when they touch identity, database, encryption or network code.

  • Scoring external dependencies by access

    Severity that reflects what data and access a third-party component has.

  • One-click GitHub issues

    Today the tool pre-fills the issue and you submit it; later it can create it directly with a scoped token.

  • Shared finding history

    Status and drift are saved in your browser today; later they sync across devices and teammates.

  • More benchmark apps

    OWASP Juice Shop and DVWA alongside NodeGoat and the seeded repositories.

  • Local models for cheap steps

    Classification and question drafting on a local model, keeping Claude for the heavy reasoning.