Building Your Own Check

Anatomy

A check is one Go file that registers metadata (id, severity, CVSS vector, rationale, detection, fix, verify, references, standards) and a Run function. Registration refuses checks without documentation or citations.

Read-Only by Construction

Run receives a sys.System with only read operations, an allow-list of read-only commands, and loopback-only HTTP. There is nothing to call that could change the machine or reach another one.

Proving It

Add lab fixtures in internal/lab so the simulated vulnerable server triggers your check and the hardened server passes it. The engine tests fail until both behave. That is how false positives and false negatives are caught before release.

In Summary

A check is a small Go file with full documentation and tests. It must fail on the vulnerable lab and pass on the hardened lab.

Apply It

These OpenVAPT checks put this module into practice. Open one to see its detection logic and source code.

Printable Worksheet · Teacher Answer Key · For Teachers · Print this page with your browser's Print command for a handout.

Also available as plain Markdown for notes, scripts and AI tools. Same facts, same source, no styling.

Lab

1. Read internal/checks/host/logging_time.go and internal/check/check.go.
2. Follow the steps on the Learn page to add a small check, then run go test ./...

Check Yourself

Answers are checked in your browser and never stored or sent.

References

• OpenVAPT source code

Adapted from the OpenVAPT Academy (openvapt.com), built by AI Cybersecurity Engineers, used under the OpenVAPT Source-Available Licence 1.3. Free teaching use under Teaching With OpenVAPT. Pre-release material may be wrong or unstable; use at your own risk.

OpenVAPT. (2026). A4: Building Your Own Check (Version 0.1.0-alpha.6). OpenVAPT Academy. Retrieved October 16, 2026, from https://openvapt.com/academy/a4.html

@misc{openvapt_a4,
  author       = {{OpenVAPT}},
  title        = {{A4: Building Your Own Check}},
  year         = {2026},
  howpublished = {\url{https://openvapt.com/academy/a4.html}},
  note         = {OpenVAPT Academy, version 0.1.0-alpha.6. Accessed 16 October 2026}
}