Vikramaditya Narayan (Vikram) vikram-s-narayan

Go to https://app.precogly.org and click on "Start Threat Modeling". Then draw the DFD for this system.

PocketLedger is a personal expense tracker. Users log in, add expenses, and view monthly totals. It does not connect to banks or transfer money.

Actor: Registered user. Components: Browser web app, backend API, PostgreSQL database. Trust zones: User device contains the web app. Private server contains the API and database. Flows: Web app ↔ API over HTTPS; API ↔ database over TLS. Assets: Email addresses, password hashes, sessions, and expense records containing date, amount, and category. Assumed controls: Hashed passwords, secure session cookies, input validation, daily backups, and API authorization checks restricting users to their own expenses.

Precogly Hands-On Session: Setup Guide

This guide gets Precogly running on your own laptop in about 15 minutes. It works on Mac and Windows. Everything runs inside Docker, so you do not need to install Python, Node or PostgreSQL yourself.

1. Install the tools

You need two things:

Tool	Mac	Windows

Generate a Threat Model with AI for Precogly

You are a threat modeling assistant. Your job is to help the user create a structured threat model for their system and produce a CycloneDX 2.0 TM-BOM JSON file that can be directly imported into Precogly, the OWASP threat modeling platform.

What you will produce

A single .cdx.json file containing:

A blueprint describing the system's architecture (Precogly converts this into a visual Data Flow Diagram)
Threats identified using the STRIDE methodology

Precogly Contributor License Agreement

Thanks for your interest in contributing to Precogly. This agreement explains the rights you give the OWASP Foundation when you contribute code, docs, or other work to the project. Please read it and accept before your contribution can be merged. Once you accept, this agreement covers this contribution and any future contributions you make to Precogly.

"OWASP" means the OWASP Foundation, Inc., a US 501(c)(3) non-profit that hosts and stewards the Precogly project.

"Precogly" means the Precogly project as hosted by OWASP at github.com/owasp/precogly, including its successors and assigns.

"You" means you personally, or the company you're contributing on behalf of. If you're contributing for a company, that company and its subsidiaries count as one contributor.

Project Details:

Org: SciML-NumFOCUS

Contributor: Vikramaditya Narayan

Mentors: Chris Rackauckas and Ranjan Anantharaman

	{
	"specFormat": "CycloneDX",
	"specVersion": "2.0",
	"serialNumber": "urn:uuid:db3d5971-5fdc-4e06-8cdc-6734ddbe080e",
	"version": 1,
	"metadata": {
	"timestamp": "2026-09-20T16:35:28.896119+00:00",
	"tools": {
	"components": [
	{

	# The purpose of this gist is to help pinpoint a potential bug in
	# QuasiMonteCarlo. This gist shows the working of the GEKPLS surrogate model
	# without the potential interferences from other Surrogates dependencies.
	# To run the gist and reproduce the results:
	# Run this gist with QuasiMonteCarlo@0.2.19; it can be seen that it produces
	# far better results without the first data point in the test dataset
	# Additional notes:
	# - Ensure that no other packages that depend on QuasiMonteCarlo are in your package environment
	# - QuasiMonteCarlo@0.2.17 and QuasiMonteCarlo@0.2.18 throw errors. More info for the cause can
	# be seen here - https://github.com/SciML/QuasiMonteCarlo.jl/releases/tag/v0.2.17

	# The purpose of this gist is to help pinpoint a potential bug in
	# QuasiMonteCarlo. This gist shows the working of the GEKPLS surrogate model
	# without the potential interferences from other Surrogates dependencies.
	# To run the gist and reproduce the results:
	# Run this gist with QuasiMonteCarlo@0.2.16 => all tests pass (evidenced by 3 true prints)
	# Then run this gist with QuasiMonteCarlo@0.2.19 => all tests fail in a fashion similar to
	# the failing tests of Surogates.jl - https://github.com/SciML/Surrogates.jl/pull/420
	# Additional notes:
	# - Ensure that no other packages that depend on QuasiMonteCarlo are in your package environment
	# - QuasiMonteCarlo@0.2.17 and QuasiMonteCarlo@0.2.18 throw errors. More info for the cause can

	#Add this line below
	#above https://github.com/SMTorg/smt/blob/4a4df255b9259965439120091007f9852f41523e/smt/surrogate_models/krg_based.py#L1165
	#to try different theta values
	optimal_theta = np.array([0.0001, 0.0001])

	optimal_rlf_value, optimal_par = self._reduced_likelihood_function(
	theta=optimal_theta
	)

	using Surrogates
	using Zygote
	using SurrogatesPolyChaos
	using SurrogatesAbstractGPs
	using AbstractGPs

	function vector_of_tuples_to_matrix(v)
	#helper function to convert training data generated by surrogate sampling into a matrix suitable for GEKPLS
	num_rows = length(v)
	num_cols = length(first(v))