A structured security review workspace for teams that need clarity before they ship.
Quick start · Product tour · Analysis providers · Security notes
5STONES turns the system context you already have a PRD, API specification, database schema, or rough description into a clear, review-ready security dossier. It brings architecture context, trust-boundary decisions, STRIDE and LINDDUN findings, control mappings, test scenarios, evidence, and open questions into one supporting document for engineering, security, and QA teams.
| Dashboard Track projects and risk posture |
Analysis diagram Explore components and trust zones |
Security report Turn findings into action |
 |
 |
 |
- Start with incomplete information. Import what exists and make gaps explicit instead of waiting for perfect documentation.
- Ground findings in context. Review trust boundaries, evidence, confidence, and assumptions before acting on a result.
- Give every role a next step. Developers get controls and test scenarios; security teams get threat classification; QA gets an actionable backlog.
- Keep the workflow flexible. Use the built-in analysis engine, a connected provider, or a local model while keeping the review structure consistent.
Context → Parse & reconcile → Review trust boundaries → Analyze → Act
PRD OpenAPI/Postman STRIDE + LINDDUN Controls Tests
Schema Markdown/CSV Evidence & assumptions Gaps Reports
python -m venv .venv
source .venv/bin/activate # macOS/Linux
pip install -r requirements.txtcp .env.example .env
# Edit .env and set your provider values.For a connected provider, configure OPENAI_API_KEY, OPENAI_BASE_URL, and OPENAI_MODEL. For local inference, use the local endpoint settings shown in .env.example.
python -m backend.mainOpen http://127.0.0.1:8000 in your browser.
| Capability | Status |
|---|---|
| Project management | ✅ |
| Artifact upload and structured parsing | ✅ |
| Evidence-backed trust-boundary review | ✅ |
| STRIDE threat generation | ✅ |
| LINDDUN privacy analysis | ✅ |
| Control mapping from built-in catalog | ✅ |
| Test scenario generation | ✅ |
| Connected analysis provider configuration | ✅ |
| Local analysis runtime | ✅ |
| Markdown, CSV, and JSON export | ✅ |
| Audit logging | ✅ |
The review workflow can use any OpenAI-compatible endpoint or a local inference server:
| Provider | Base URL |
|---|---|
| OpenAI | https://api.openai.com/v1 |
| Azure OpenAI | https://<resource>.openai.azure.com/openai/deployments/<model> |
| OpenRouter | https://openrouter.ai/api/v1 |
| Ollama | http://localhost:11434/v1 with OPENAI_API_KEY=ollama |
| LM Studio | http://localhost:1234/v1 |
| Input | Formats |
|---|---|
| Product requirements | Plain text, Markdown, PDF, DOCX |
| API contracts | OpenAPI / Swagger YAML or JSON |
| API collections | Postman JSON, HAR |
| Data models | SQL or text database schema |
| API inventory | CSV |
Work with incomplete information. Real threat modeling rarely starts with a complete picture. 5STONES surfaces confidence scores and missing information alongside every finding.
Make assumptions visible. If the analysis infers something it was not told, that assumption is recorded, reviewable, and editable.
Produce role-aware output. A finding is only useful when the right person can act on it. Every report connects threats to controls, owners, evidence, and executable tests.
- Keep secrets in
.envor a managed secret store. Never commit real API keys, local settings, audit logs, generated reports, or runtime caches. - Use a strong, unique
APP_SECRET_KEYfor every environment. - The included server is intended for local development/MVP use. Add authentication, authorization, restricted CORS, rate limiting, and provider URL allowlisting before exposing it publicly.
5STONES is named after the principle that a small, well-aimed effort built on what you already have is more effective than a perfect tool you never use.