An open source threat modeling tool from OWASP
C-Rank Grade: A (Welcoming) - 65/100
External PR Merge Rate: 84%
Response Time: 14h
First Timer Success: 78%
OWASP/threat-dragon has a recorded first-timer success rate of 77.8%. Repositories ranked A typically provide actionable feedback during code reviews and actively nurture new community contributors.
Maintainers in OWASP/threat-dragon respond to incoming external pull requests in approximately 14.0 hours on average. Keeping PRs focused on single tasks and ensuring tests pass helps maintainers review faster.
The C-Rank™ system evaluates GitHub projects on a 0–100 scale using real data: PR merge rates, review turnaround time, active maintainer presence, and first-time contributor success. A score of 65.3 places OWASP/threat-dragon in the A tier.
The external contributor pull request merge rate for OWASP/threat-dragon is 84.3%, based on public PR activity from non-core contributors.
OWASP/threat-dragon currently has 2 active issue(s) tagged with beginner-friendly labels like "good first issue", "beginner", or "up-for-grabs".
Highly welcoming maintainers in OWASP/threat-dragon. Prompt code reviews with positive guidance for new contributors.
Average Response Latency
Tracks hours until a maintainer leaves a review, comment, or PR response.
External Acceptance Rate
Percentage of community pull requests successfully merged into main.
First PR Conversion
Rate at which developers submitting their first repository PR succeed.
Show contributors that your repository actively reviews and merges external pull requests.
[](https://getmerged.abhishekco.de/OWASP/threat-dragon?utm_source=github&utm_medium=badge)
Historical health & responsiveness evolution
External PR acceptance
First PR success rate
50% receive response in
90% receive response in
Maintainer review activity heatmap & prime window prediction
Calculating local time...
Calculating local time...
Detected: UTC
Maintainers are most responsive around 14:00 UTC (14:00 UTC in your timezone). Recommended submission window is Wednesday - Friday from 12:00 to 16:00 UTC (12:00 - 16:00 UTC local).
Limited recent maintainer review activity recorded for this repository. Prediction based on heuristic baseline.
Maintainer Strategy: Maintainer Sweet Spot: PRs under 150 lines merge in ~9 hours (96% approval). Large PRs (>500 lines) take ~67 hours (38% approval). Keep your diff compact for rapid review.
Enter your branch size and test coverage below to forecast review turnaround and get 1-click git splitting commands.
Alternative open-source projects with active maintainers in JavaScript.
OpenLayers
The future of Node.js REST development
Kantai Collection Game Viewer and Tools
Describe what problem your feature request solves: The Trivy scan in the housekeeping action was happy to report no CVE findings, whereas the Trivy scan in the pull requests was reporting CVEs for some time Describe the solution you'd like: Work out why Trivy was passing in one workflow and flagging CVEs in another workflow Provide explanation and fix if necessary Declaration: By submitting this issue you have: read the contribution guide and agree to the Code of Conduct not used agentic or generative AI in creating this feature request Additional context: This is a great first issue for someone! If you are new to Threat Dragon, reading the docs and understanding the code is a great first step! You are also uniquely qualified to find blind-spots in the documentation as you fix this. 😎 This should not be done using Generative AI or an agent. "Good first issues" are meant for our human friends to learn and start participating. If you have questions after being assigned the issue,
Describe what problem your feature request solves: The documentation does not have a "quick start" guide for new users Describe the solution you'd like: The documentation should provide a "quick start" guide for new users to help them quickly start using Threat Dragon, draw diagrams and add threats Ideally it will be a new page at the top level in the documentation : https://www.threatdragon.com/docs/ Declaration: By submitting this issue you have: read the contribution guide and agree to the Code of Conduct not used agentic or generative AI in creating this feature request Additional context: This is a great first issue for someone! If you are new to Threat Dragon, reading the docs and understanding the code is a great first step! You are also uniquely qualified to find blind-spots in the documentation as you fix this. 😎 This should not be done using Generative AI or an agent. "Good first issues" are meant for our human friends to learn and start participating. If you have ques
Rate what actually matters after opening a pull request here.
Rate your first-hand PR experience (review speed, maintainer responsiveness, and onboarding ease) to help other contributors.
When evaluating whether to contribute to OWASP/threat-dragon, response velocity and maintainer engagement are crucial. GetMerged continuously tracks pull request trajectories, first-comment latency, and code review rounds to help developers avoid submitting pull requests to backlogged repositories.
Currently, maintainers of OWASP/threat-dragon acknowledge new external contributions in approximately 13 hours. Out of all submitted pull requests from non-core authors in the last 180-day window, 84.3% were successfully merged into the primary branch.
OWASP/threat-dragon has a recorded first-timer success rate of 77.8%. Repositories ranked Welcoming typically provide actionable feedback during code reviews and actively nurture new community contributors.
The initial maintainer response time averages ~13 hours. Keeping PRs scoped to single concerns and ensuring CI checks succeed will optimize review turnaround.
The C-Rank™ index scores repositories on a 0 to 100 scale using an objective formula: external PR merge rates, initial response speed, active maintainer count, and first-time contributor retention. A score of 65.3 places OWASP/threat-dragon in the Welcoming tier.
The external pull request merge rate is 84.3%. GetMerged isolates non-core community contributions so external developers get an accurate benchmark of PR acceptance probability.
Yes, OWASP/threat-dragon currently has 2 active issue(s) tagged with beginner-friendly labels. You can inspect these directly from the repository issues tab.
All metrics displayed for OWASP/threat-dragon are automatically retrieved via the public GitHub API and recalculated daily. Insider pull requests submitted by repository owners or organization members are excluded from merge rate calculations to preserve objective external contributor statistics.