• Offline support
• Import/export functionality
• JSON schema validation
• First stab at automatic diagram layouts
• Support for basic STRIDE modeling
• Functionality related to tracking assets
• Initial look and feel and some basic UX work
• Foundational things like various categories, graph structure etc
• Simple presentation website and documentation.

• Collect feedback from community and pilot projects
• Iron out major bugs
• Small improvements to UI
• Delete confirmation dialogs everywhere (including clear display of what happens if something is removed or deleted)
• Add support for executive reports
• Ask for confirmation when importing a project with an existing id. Offer to create as a new project.
• Performance improvements. The current solution is quite naive. There's lots of low-hanging fruit.
• There are still some issues with automatic layouts. One in particular is the way flows are routed through boundaries. A two-pass solution where the layered algorithm is applied once to layout boundaries and other nodes, and a second time with boundaries filtered out, may improve the edge routing.

• Proper CAPEC and CWE threat database
• Support for different threat sources
• Proper matching engine to match threats based on available metadata
• Add more metadata to elements for threat matching.

• Create an attack tree builder. Integrate with graph. Look at building up a small library of common actions (ATT&CK-based perhaps).
• Add support for listing assumptions. This could be the key to marking STRIDE/LINDUNN categories as reviewed. Link to elements.
• Both attack trees and assumptions go into the report

• Ability to control how mitigations are reviewed and tracked. Some mitigations are controls, other are organizational processes. Different elements may share a threat, but not the mitigations.

• Create simple a simple backend that can run in cloud and on-premises. As few moving parts as possible.
• Authentication and SSO support.
• Collaborative featues like comments/notes, conflict resolution, signed reviews, etc.
• Full auditability. Who did what an when. What has changed.
• Support for managing custom threat library sources.

LINDUNN, PASTA, STRIDE, OCTAVE, PASTA... options and freedom are nice.

There's so much to explore. Especially when it comes to AI. Both to aid in threat modeling, and to explore how to imrpove threat modeling of agentic workflows etc.