I built TITO because threat modeling is broken. It either requires drawing diagrams by hand, hiring consultants, or buying tools that start at $50K/year. Most teams skip it entirely.

TITO reads your code and builds the threat model for you:

    go install github.com/Leathal1/TITO/v2/cmd/tito@latest
    tito scan --repo .

What you get in ~60 seconds:

- STRIDE-LM classification — threats categorized by Spoofing, Tampering, Info Disclosure, DoS, Elevation of Privilege, Lateral Movement - MITRE ATT&CK mapping — every finding linked to real-world attack techniques - Attack path analysis — how individual findings chain into realistic breach scenarios (think BloodHound for app-layer threats) - MAESTRO analysis — maps threats across agentic AI security layers (if your code uses LLMs/agents) - Compliance mapping — PCI DSS v4.0, SOC 2, ISO 27001, NIST 800-53, HIPAA - Interactive 3D visualization — explorable data flow diagrams with attack path overlays - PR threat diffing — catch security regressions on every pull request

Under the hood it runs Semgrep for static analysis, detects your architecture (monolith, microservices, serverless, AI/ML), and layers threat intelligence on top.

Single binary. No config files. No accounts. No data leaves your machine.

The Cloud Security Alliance is listing TITO as a community implementation of their MAESTRO framework for agentic AI security.

CI/CD integration:

    - uses: Leathal1/TITO@v2
      with:
        maestro: true
        fail-on: critical

Technical details: written in Go, ~15K LOC, MIT licensed. GitHub Action on the Marketplace. Docker images available.

I'd love feedback — especially from folks doing AppSec or building AI agents. What frameworks or compliance mappings would be most useful to add?

GitHub: https://github.com/Leathal1/TITO

Divergent vs. Convergent Phases

The Hans Island "Loophole"

Sonar: Voice, transcribed instantly. No cloud. No monthly fees

People are sleeping on how much Rails+Claude is a *crazy unlock

Why Kubernetes is retiring Ingress Nginx

DOJ and DHS indict 11 for Chinese national sham marriages, incl to US sailors

Leigh Light – WW2

DS Standard Foundation – Alternatively Sized Keyboards

When the Gut Produces Alcohol Without Drinking

TypoSnap – Highlight text, hit Ctrl+Shift+F, typos gone (Windows)

Russian spy satellites have intercepted EU communications satellites

Show HN: TITO – Automated threat modeling from code (open source)

Show HN: Job Tracker, Local-first job search app powered by Claude Code

How to find work (early draft)

Soniox: Real-time transcription in 60 languages

How poor site design outed a furry councilman

Ovid, a super fast parallel PDF and image converter

Nuke Map

We built a real-world benchmark for AI code review

DMA enforced an option to sort Ig/FB feeds chronologically

Playwriter, extension to control Chrome with agentic CLIs

Using Ghidra to correct the record on a 24 year old PlayStation game

Rent vs. Buy Simulator – Compare 3 financial strategies over 10-40 years

The 'weird' things that happened when ClickHouse replaced C++ with Rust

Codex Ambassador Program

Most side projects die from 3 failed tweets, not bad ideas

Spotlighting the World Factbook as We Bid a Fond Farewell

Japan begins 24-hour social media monitoring at Winter Olympics

Small acts of culture drive major change

Olympic curling: The science behind sweeping

Ask HN: How can you enforce rules for Claude etc.

Comments