How do you draw a data flow diagram in Mermaid for a threat model?

Write the diagram as text in Mermaid, using a flowchart with one node per process, store or external entity, a subgraph for each trust boundary, and a label on every arrow. The file lives in your repository, shows up in pull request diffs, and renders in many Markdown viewers.

Why text diagrams suit threat models

OWASP says to save diagrams in a form the team can update. A diagram in a slide deck goes stale. A text file next to the code is edited by the same people who change the system, and a diff shows what changed in the design.

The Mermaid pieces you need

From the Mermaid flowchart syntax:

• Start with the word flowchart and a direction, such as LR for left to right or TD for top down.
• Give nodes an id and a label.
• A cylinder shape marks a database; the short name is cyl, with database and db as aliases.
• A subgraph wraps related nodes and ends with the word end.
• Text goes on an arrow between link markers.

One gotcha from the docs: typing the word end in all lowercase inside a node label breaks the flowchart. Capitalize it.

A small example

flowchart LR
    User((Customer))
    subgraph Internet [Untrusted]
        User
    end
    subgraph Backend [Trusted backend]
        API[Orders API]
        DB@{ shape: cyl, label: "Orders DB" }
    end
    User ==>|HTTPS order request| API
    API ==>|SQL query| DB

The two subgraphs are the trust boundaries. Every arrow that crosses from Untrusted into Trusted backend is a place to ask the STRIDE questions. I used thick arrows here so the example avoids the double hyphen form; the standard arrow syntax also works.

Conventions that keep the diagram useful

1. One arrow per data flow. Label it with what moves and over which protocol.
2. Name the data. If an arrow carries personal data or credentials, say so in the label.
3. Group by trust, not by team. Boundaries should reflect who can be trusted, not the org chart.
4. Keep a top level diagram and detail diagrams. OWASP suggests a high level view plus detailed views for complex parts.
5. Review the diagram in the same pull request as design changes.

Limits to know

A Mermaid diagram does not generate threats. It supports the conversation. For generated candidate threats from code, see what pytm does. Also check how your viewer renders Mermaid, because support varies.

Quick check

A note on tooling

A diagram is design work. Once the system is built, Safeguard can scan its dependencies and generate SBOMs. A free scan is available.

Sources

• Mermaid flowchart syntax
• OWASP Threat Modeling Cheat Sheet

Last reviewed: 19 October 2026.