“It's like a specification to define somewhat programmatically a threat model and then some tooling to turn that into a human-readable file that in theory can live inside of the software repo along with the software and it can be managed with GitHub.”

Transcript evidence from Christian Frichot -- Threat Modeling with hcltm.