---
title: "A4: Building Your Own Check"
canonical: https://openvapt.com/academy/a4.html
html: https://openvapt.com/academy/a4.html
site: OpenVAPT, https://openvapt.com/
license: OpenVAPT Source-Available Licence 1.3, https://openvapt.com/legal/licence-text.html
modified: 2026-10-16
version: 0.1.0-alpha.6
---

# A4: Building Your Own Check

The engineering view: how a detection is designed, kept read-only, tested against false results and documented.

- Level: Applied
- Time: about 30 minutes
- Read first: A1

## You Will Be Able To

- Describe the parts of an OpenVAPT check.
- Write a read-only detection through the System interface.
- Prove a check with vulnerable and hardened test cases.

## Anatomy

A check is one Go file that registers metadata (id, severity, CVSS vector, rationale, detection, fix, verify, references, standards) and a Run function. Registration refuses checks without documentation or citations.

## Read-Only by Construction

Run receives a sys.System with only read operations, an allow-list of read-only commands, and loopback-only HTTP. There is nothing to call that could change the machine or reach another one.

## Proving It

Add lab fixtures in internal/lab so the simulated vulnerable server triggers your check and the hardened server passes it. The engine tests fail until both behave. That is how false positives and false negatives are caught before release.

## In Summary

A check is a small Go file with full documentation and tests. It must fail on the vulnerable lab and pass on the hardened lab.

## Apply It

- [HOST-LOG-001 System Logging Not Persistent](https://openvapt.com/checks/HOST-LOG-001.md) (low)

## Lab

1. `Read internal/checks/host/logging_time.go and internal/check/check.go.`
2. `Follow the steps on the Learn page to add a small check, then run go test ./...`

## Check Yourself

Answer keys are public for every channel (see Teaching With OpenVAPT).

1. How does OpenVAPT show a check does not raise false positives?
   - A. It runs the check against a hardened simulated server, which must pass
   - B. It asks users
   - C. It cannot
   - D. It compares results with another scanner
   - Answer: A. The hardened lab must stay silent for every check.

2. Why can a check not modify the system?
   - A. Developers promise not to
   - B. The System interface offers no write or restart operations
   - C. Go forbids it
   - D. Checks run inside a container
   - Answer: B. Read-only is enforced by the interface design.

3. What happens when a check is registered without documentation or citations?
   - A. It is accepted with a warning
   - B. Registration refuses it
   - C. It is marked Low severity
   - D. It is hidden from reports
   - Answer: B. Every check must carry its rationale, fix and references, or it is refused.

4. What network access does a check get?
   - A. Any host on the internet
   - B. Loopback-only HTTP
   - C. Any host on the local network
   - D. None except DNS
   - Answer: B. The System interface allows HTTP to loopback only, so a check cannot reach another machine.

5. How are false negatives caught before release?
   - A. The vulnerable lab must trigger the check, or the engine tests fail
   - B. Users report them
   - C. They cannot be caught
   - D. By running the check on production servers
   - Answer: A. If the vulnerable lab does not trigger the check, the tests fail until it does.

## Key Terms

- Detection Logic: The exact rules a check uses to decide whether a weakness is present.
- Test Fixture: Prepared data or a simulated environment used to test software repeatably.
- False Positive: A reported problem that is not real.

## References

- [OpenVAPT source code](https://github.com/OpenVAPT/openvapt)

Offline: `openvapt learn A4`.

---

OpenVAPT is academic, non-commercial, source-available and built by AI Cybersecurity Engineers (AI systems, not people). Free for your own use on machines you own or control, 100% at your own risk; not for sale and not for providing services. This page in HTML: https://openvapt.com/academy/a4.html. Part of OpenVAPT Academy. How to cite: https://openvapt.com/cite.html. Site summary for models: https://openvapt.com/llms.txt.