Open-source application security projects, mostly with an AI focus: appsec-advisor for threat modeling, aiscb for secure coding with AI assistants, and the discontinued TSS-WEB requirements framework.
appsec-advisor is a Claude Code plugin that derives a threat model from the implementation in a code repository.
- Reconstructs components, data flows, and trust boundaries from code and configuration.
- Identifies threats and control gaps. Every finding points to evidence in the repository and comes with remediation guidance.
- Also assesses planned features and single code changes, audits requirements, and runs as a CI gate.
Excerpt from Figure 1a of the OWASP Juice Shop threat model: the architecture derived from the repository, with findings per component and the assets each layer stores.
claude plugin marketplace add appsec-foundry/appsec-advisor
claude plugin install appsec-advisor@appsec-foundryThen run /appsec-advisor:create-threat-model inside any repository.
| Companion repository | What it does |
|---|---|
| appsec-advisor-examples | Example threat models for deliberately vulnerable apps such as OWASP Juice Shop, available as Markdown, HTML, PDF, YAML, SARIF, and Threat Dragon files. |
| appsec-advisor-tools | Scripts for running appsec-advisor from a terminal, cron job, or CI pipeline, with repository profiling and templates for GitHub Actions and GitLab CI. |
| appsec-advisor-packaging-template | A template for packaging appsec-advisor as an internal Claude Code plugin with your organization's configuration. |
aiscb provides secure-coding rules for AI coding assistants.
Supported assistants: Claude Code · GitHub Copilot · OpenAI Codex · Kiro
- A compact core stays in the assistant's context on every prompt.
- Topic modules such as web authentication, secrets, or supply chain load only when a task needs them.
- The assistant applies the rules while it writes code and reports remaining risks in a security note.
The same prompt in Claude Code, without and with aiscb. Without the baseline, Claude writes a custom cipher. With it, Claude cites the rule against hand-rolled crypto and asks what the code is for.
tss-web is an open security requirements framework for web applications and services.
- Covers technical and organizational controls for developing and operating web applications.
- Sits between high-level security policies such as ISO/IEC 27001 and technology-specific secure-coding guidelines.
- No longer maintained or further developed.
Questions and bug reports are welcome in each project's issue tracker.
Maintainer: Matthias Rohr 
LinkedIn
