Task: apply for OWASP Production status

[jgadsden]

OWASP executive have asked that Treat Dragon apply for project 'Production' status.
Refer to what is required for project promotions

Declaration:

By submitting this issue you have:

• read the contribution guide and agree to the Code of Conduct
• not used agentic or generative AI in creating this feature request

Additional context:

OWASP project policy

[lreading]

Exciting times!!!
I wanted to take a crack at reviewing the requirements to make sure we are where we need to be. 😎
It looks like accessibility is the one area where we are lacking. That is listed as optional, but it is also called out on our roadmap, so we should get there soon!

Production Maturity Requirements:

Requirement	Production Definition	Evidence	Achieved
Activity	≥1 major release per year and regular minor/patch releases	Releases	👍
Documentation	Fully scoped usage documentation, Contribution guidelines etc. exist	Docs	👍
Support	Slack channel or other support queue are monitored and managed; GitHub issues are properly managed and worked on	Slack in OWASP, Issues	👍
Contributions	Contributor onboarding is managed properly; Project participated in ≥1 GSoC, OWASP Project Summit or similar event; PRs are monitored and managed	GSOC, contributing guidelines, pulls	👍
Usage	Evidence of significant use, e.g. via GitHub, DockerHub, SourceForge statistics	> 1200 GH Stars, 100k+ Docker Downloads	👍
Age	>= 1 year	Repo history	👍
OWASP Project Good Practices	Fully taken into account	See table below	👍
OSSF Best Practices	Criteria for at least passing level badge fulfilled	Well above passing, now aiming for Silver or Gold level criteria	👍

OWASP Good Practices:

Requirement	Production Definition	Evidence	Achieved
Project Metadata	Project has a clear name, description, and is listed on OWASP site	OWASP project page, GitHub repo	👍
Licensing	OSI-approved license clearly defined	LICENSE file (Apache 2.0)	👍
Code Repository	Source code is publicly available and actively maintained	https://github.com/OWASP/threat-dragon	👍
Issue Tracking	Public issue tracker is used and maintained	GitHub Issues	👍
Documentation	Project documentation exists and is maintained	https://www.threatdragon.com/docs	👍
Build/Install Instructions	Clear instructions for building and running the project	README, Docs	👍
Release Process	Documented and repeatable release process exists	GitHub Releases, workflows, docs, release-process.md	👍
Versioning	Consistent versioning scheme is used (e.g. semver)	GitHub releases/tags	👍
Security Policy	Security policy and vulnerability disclosure process defined	SECURITY.md	👍
Code of Conduct	Project follows OWASP Code of Conduct	code_of_conduct.md	👍
Contribution Guidelines	Clear CONTRIBUTING.md and onboarding guidance	CONTRIBUTING.md	👍
Project Leaders	Named project leaders with contact info	OWASP project page	👍
Roadmap	Public roadmap or documented future direction exists	GitHub discussions / www-site	👍
Dependencies	Dependencies are tracked and maintained	package.json, dependabot	👍
Testing	Project includes automated tests	Unit/E2E tests in repo	👍
CI/CD	Continuous integration is configured and enforced	GitHub Actions	👍
Packaging/Distribution	Artifacts are distributed in a standard way (e.g. releases, Docker)	GitHub Releases, DockerHub, multiple formats/platforms for desktop	👍
Open Governance	Project operates transparently with community input	GitHub discussions, OWASP Slack, town halls coming soon	👍
Branding	Uses OWASP branding appropriately	OWASP project page	👍
Internationalization (Optional)	Supports multiple languages where applicable	Translations impleemented	👍
Accessibility (Optional)	Considers accessibility in UI/UX	Partial / not formally documented	❌
Metrics	Project tracks usage or health metrics	Stars, downloads, community activity	👍
Community Engagement	Evidence of active community participation	Slack, issues, PRs	👍

[jgadsden]

The OpenSSF good practices is tracked by our badge in the readme, https://www.bestpractices.dev/en/projects/9266/passing
and Threat Dragon is surpassing the Passing criteria, and now aiming for Silver or Gold level criteria.

@lreading you can login using your github profile? https://www.bestpractices.dev/en/login

[lreading]

I'm not an owner of it (which is fine!), but I can see it. I'm confused though, is that link different from what I linked in the table?

I'll update the status though to highlight that we're way ahead of passing, it's a great callout!!! 🎉