stephanev/risk-analysis-editorBrowser-based risk analysis editor for building risk matrices, risk registers, and action plans. Supports EBIOS RM, ISO 27005, and CNIL DPIA with offline .rae.json files.
Risk Analysis Editor (RAE)English · Français
Standalone tool for building and visualizing risk matrices — inherent (gross) risk and residual (net) risk — with an open, documented file format, .rae.json.
No installation: the tool runs entirely in your browser. Two ready-to-open demos: 📊 an EBIOS RM–inspired risk analysis (12 risks, 11 measures) and 🛡️ an example of the risk-analysis part of a DPIA, inspired by the CNIL PIA method, focused on feared events, controls and residual risk (12 risks, 12 measures) — both showcasing descriptions, notes, colored tags, progress bars, owners and per-link rationale. The download provides the single HTML file of the latest release: double-click it to work offline.
Matrices › Trajectory view: each arrow links a risk's initial position (dashed outline) to its residual position (solid outline).
Statistics tab: key counters and distributions — by criticality (initial → residual), category, measure type and status, custom field, and coverage — as tables and/or charts (donut or pie). The grid is customizable and rearrangeable by drag-and-drop, and follows the active filter.
Action plan — timeline: controls sorted by due date, with owner, status and covered risks. Also available as a status board (kanban) and by owner, with progress and overdue tracking.
Risk Analysis Editor is a standalone web app: a single HTML file, with no network or external service dependency at runtime, that works offline (a simple double-click is enough — no installation, no server).
It lets you carry out a generic, structured risk analysis: scoring configuration, entry of risks and measures, initial and residual assessment, action plan, visualizations and reports.
The tool builds on a generic, configurable model, adaptable to an internal framework and usable to structure and present analyses conducted within approaches such as ISO 27005, EBIOS RM or the DPIA. The grid is broadly configurable: dimensions, axes, levels, labels, thresholds, colors and scoring method; it is saved inside the file.
The whole analysis fits in a self-contained .rae.json file: grid, risks, measures, links and initial/residual assessments. The format is specified (technical documentation, in French) and comes with a JSON schema for validation (schema-analyse-risque.json). Property names are in English; values (labels, descriptions) stay in the analysis's own language.
Official website: www.risk-analysis-editor.com — presentation, screenshots and links.
YouTube channel: @RiskAnalysisEditor — video tutorials.
Getting started: the illustrated user guide (in French) walks through every screen and feature.
Entry point: open the app online — or, for offline use, download the repository and open app/risk-analysis-editor.html with a simple double-click.
RAE focuses on structuring, assessing and presenting risk and measure registers: defining the scoring grid, initial and residual assessment, linking measures to risks, tracking the action plan, visualizing the matrices and generating reports.
Its generic, configurable model lets you work with different approaches — notably ISO 27005, EBIOS RM, DPIA/PIA CNIL or an internal framework — without imposing a single methodology. The provided templates and examples are inspired by these approaches and serve as ready-to-adapt starting points. RAE does not, however, aim to reproduce the full set of steps, objects and controls specific to each method: their complete implementation remains guided by the applicable frameworks and by the context of the analysis.
RAE thus offers a framework that is more structured and consistent than a set of spreadsheets, while remaining lighter, more portable and simpler to deploy than a GRC platform. It is particularly suited to standalone analyses, workshops, consulting engagements and organizations that want to keep local control of their data in an open, documented format.
Enter/Space to edit, Ctrl+arrows to re-score).; delimiter and UTF-8 BOM (Excel), with read-only derived columns (score/criticality for risks; covered risks for measures; labels for links); re-importable..rae.json format.?file=<url> (alias ?url=) automatically loads the pointed analysis at startup — e.g. risk-analysis-editor.html?file=../examples/demo-ebios-rm-information-system.rae.json. Requires the tool to be served over HTTP(S) (the file:// protocol blocks this read).?lang=fr|en|it forces the interface language (overrides the file's saved language and the browser language); ?tab=<tab>[.<sub-tab>] opens a given tab, and optionally its sub-tab — e.g. ?tab=matrices.traj (Matrices › Trajectory), ?tab=settings.grid, ?tab=plan; ?filter=code:value;… applies custom-field filters (it overrides the saved custom-field part of the filter, then is removed from the address bar). Unknown tokens are ignored.app/risk-analysis-editor.html from a local copy, in a recent browser..rae.json file (e.g. from examples/), Save to export yours.Prerequisites: a recent desktop browser (evergreen version) with JavaScript enabled — nothing else. No server, no network access and no installation are required; the app runs from a simple file:// double-click. Only Load by URL (?file=…) needs the tool to be served over HTTP(S).
Development and testing are done primarily with Microsoft Edge (Chromium); recent desktop browsers based on Chromium (Chrome, Edge, Opera, Brave…) are the primarily tested environment and should offer the most complete experience. Known differences with other engines:
showSaveFilePicker) is not available: Save falls back to a standard download of the .rae.json file (and Load to a classic file picker) instead of writing directly into the opened file. The main features remain available on Firefox and Safari, but differences may exist, notably for the clipboard, file handling, printing and the rendering of generated documents.ClipboardItem) is not supported; the PNG and SVG download buttons remain available.RAE embeds exactly one third-party library: fflate v0.8.2 (MIT license, © Arjun Barrett), a tiny, fast ZIP/deflate implementation. It provides the ZIP container required by the Word (.docx) and Excel (.xlsx) exports — OOXML files being ZIP archives of XML parts. The library is vendored inline in the HTML file, with its license notice, so the app keeps working fully offline, with no external resource needed at runtime. Everything else (Markdown engine, SVG/PNG export, OOXML generation, UI components) is written from scratch for this project.
Found a bug or have a suggestion? Open a GitHub issue. For bugs, please include your browser and OS, the app version (shown in About), what you expected, what actually happened, and — when possible — a minimal .rae.json that reproduces it (zip it or paste it in a code block, since GitHub does not accept .json attachments directly).
Distributed under the MIT license — see LICENSE.
© 2026 Stéphane Vinter
? key).extensions.display.columns).{title}, {date}, {page}/{pages}…), each table's columns, the metadata rows, the Initial/Residual matrix layout (side by side or stacked) and the action-plan view, plus the scope (full analysis or filtered subset). The same configuration determines the sections, their order, the columns and the scope of the on-screen/PDF and Word renders (with native table of contents and header/footer); it is saved in the file (extensions.display.report).| Folder | Contents |
|---|
app/ | The application (risk-analysis-editor.html). |
docs/ | User documentation (in French): the illustrated user guide, and shared images. |
specs/ | Specifications (in French): file-format specification, JSON schema and layout strategies. |
examples/ | Sample analyses in .rae.json format (French and English), including two populated demos representative of RAE's features: an EBIOS RM–inspired risk analysis (demo-ebios-rm-*.rae.json) and an example of the risk-analysis part of a DPIA, inspired by the CNIL PIA method, for an occupational health service (demo-aipd-sst.rae.json / demo-dpia-ohs.rae.json) — with colored tags, progress bars, owners and justified links. |
templates/ | Starter templates (xxx.template.<lang>.rae.json, one file per language) for analyses inspired by common methods and frameworks: blank skeletons — grid, criticality levels and custom fields preconfigured, no risks or measures. EBIOS RM, CNIL PIA / DPIA, ISO/IEC 27005 and a generic 5×5, each in French, English and Italian. Listed under Start from a template in the onboarding block (the file matching the current interface language is loaded); opening one (from there, or via Load…) starts a new, unlinked analysis. You can also turn the current analysis into a template with File › Save as template…, and return to the onboarding block with File › Home screen. |