Threat models that keep up with the code

Neo maps trust boundaries from your design docs, API specs and architecture, updates the model as pull requests merge, and proves which threats are exploitable. Every version is kept for audit.

Get StartedBook a demo

Map every trust boundary. Neo reads design docs, API specs and code, and draws every flow that crosses one.

Threat modelsacme/checkout
Search components…
Internet
Public edge
Private VPC
Data
Customer
Partner API client
Collaborator
checkout.acme.com
api.acme.com
share.acme.com
auth-service
orders-service
invoice-service
share-service
billing-worker
sessions (redis)
orders (postgres)
invoices (s3)
ledger (postgres)
T-03Cross-tenant invoice read
Validated
Abuse cases
  • Session fixation pre-auth
  • Order total tampered
  • Cross-tenant invoice read
  • Partner key replayed
  • Refund skips approval
  • Share token guessable
  • Revoked share still reads
  • Invite allow-list bypass

Update the model on every merge. Neo re-reads each pull request, marks what moved and writes the new abuse cases.

Threat modelsacme/checkoutv13 → v14
DiffBoundariesAbuse cases
threat-model.yaml
12components:
13 - name: invoice-service
14 boundary: private-vpc
15 - name: share-service
16 boundary: private-vpc
17 exposes: [POST /share, GET /share/{token}]
18flows:
19 - customer → checkout.acme.com → orders-service
20 - external-collaborator → share.acme.com → share-service
21 crosses: internet → private-vpc
22 auth: bearer token, 7d expiry, no login
23data:
24 - store: s3://acme-invoices
25 readers: [invoice-service]
25 readers: [invoice-service, share-service]
26 external_read: true
27threats:
28 - T-05 refund workflow skips approval
29 - T-06 share token guessable or brute-forceable
30 - T-07 revoked share readable until token expiry
31 - T-08 invite allow-list bypass by token reuse
32accepted_risks:
33 - T-02 order total tampering, mitigated by server-side pricing
New abuse cases
  • T-06Testing
    Share token guessable
  • T-07Queued
    Revoked share readable until expiry
  • T-08Queued
    Invite allow-list bypass

Prove what is exploitable. Every abuse case runs in a sandbox and lands with evidence, or is closed as not reachable.

Threat modelsacme/checkoutT-06
Subscribed···
RunEvidenceMitigation
  1. Test generated from the abuse case

    Enumerate /share/{token} without a session.

  2. Sandbox run on staging

    2,310 requests in 38s, no rate limiting observed. 4 valid tokens found; the first returns another tenant’s file.

    share.acme.comOpen
    1GET /share/7f3a21 HTTP/2
    2host: share.acme.com // no cookie, no bearer
    3
    4HTTP/2 200 OK
    5{ "document": "Q3-board-deck.pdf", "owner": "tenant_8821" }
  3. Validated exploitable

    Opened ISSUE-2052 with the exchange attached.

  4. Mitigation proposed on #482

    128-bit random tokens and a per-IP limit on the lookup route.

Keep every version for audit. The model is a file: one version per change, tied to the pull request and the reviewer.

Threat modelsacme/checkoutthreat-model.md
threat-model.md
ExportShare
VersionChangeTriggerReviewed byWhen
  • v14a91f3cAdd document sharing via email invite#482Awaiting review2h ago
  • v134c07e1Rotate session cookie on login#471PRPriya Raman3d ago
  • v12b2e9d4Scope partner API keys per tenant#463PRPriya Raman6d ago
  • v1177d0aaQuarterly review, T-02 accepted riskManualSOSam Okafor12d ago
  • v10e13b90Move refund approvals to billing-worker#440JPJin Park18d ago
  • v90f5c2aServe invoice PDFs from S3#431PRPriya Raman24d ago
  • v8d4a7b8Add partner API behind api.acme.com#419ACAda Cruz31d ago
  • v79c21f0Split auth-service out of the monolith#402MLMarco Lee38d ago
  • v631be77Rate-limit login on auth-service#388PRPriya Raman44d ago
  • v5c8e412Add refund workflow to checkout#371JPJin Park52d ago
  • v45d90b3Cache sessions in redis#355PRPriya Raman61d ago
  • v3f21a6eAdd orders-service and orders (postgres)#340ACAda Cruz70d ago
  • v28b3c15Put checkout.acme.com behind Cloudflare#322SOSam Okafor81d ago
  • v102ad97Initial model from design doc and specManualPRPriya Raman92d ago

Threat models you can trust at any speed. Proven exploitability, the same depth every time, and artifacts an auditor can read.

Review every change without adding headcount

Neo watches every merge through the GitHub integration and updates the model itself. No scavenger hunt across docs, tickets and code; the security team gets continuous signal without scaling with engineering.

Consistent depth without the variance

The same analysis on every feature and every team, whoever is available and however busy the sprint. Accepted risks and past decisions persist in memory, so each review builds on the last.

Prove exploitability without manual testing

Each abuse case becomes a test that runs in a sandbox. Theoretical risk is separated from confirmed threat, with reproduction steps and evidence attached.

Compliance-ready without the scramble

Threat models are saved as versioned files that evolve with the system, every change tied to the pull request that caused it, ready for audit and leadership review.

Trusted by security teams