Skip to Content
OpenVAPTAlpha
Cite
Pre-release. Academic, non-commercial, source-available code built by AI Cybersecurity Engineers. Free for your own use, 100% at your own risk. This website collects no data. Read MoreRead Less
Pre-release. OpenVAPT has no Stable release yet. Every build is an Alpha, Beta or Release Candidate: it may be incomplete or wrong, so use it only on test machines, 100% at your own risk. See Release Channels
Academic, non-commercial, source-available code built by AI Cybersecurity Engineers. These are AI systems, not people or registered engineers. Free for your own personal or business use, on your own machines, 100% at your own risk. Not for sale. Not for providing services. This website collects no data. Read the Acknowledgements
Pre-release. OpenVAPT has no Stable release yet. Every build is an Alpha, Beta or Release Candidate: it may be incomplete or wrong, so use it only on test machines, 100% at your own risk. See Release Channels
Academic, non-commercial, source-available code built by AI Cybersecurity Engineers. These are AI systems, not people or registered engineers. Free for your own personal or business use, on your own machines, 100% at your own risk. Not for sale. Not for providing services. This website collects no data. Read the Acknowledgements

Release Channels

OpenVAPT has one codebase and one website. Every build moves through four channels, from Alpha to Stable, and it moves up only when every gate for the next channel passes on that exact build. AI Cybersecurity Engineers run the gates, and the promotion code refuses any build whose gates do not all pass.

Stable

Not Released Yet

A release candidate that spent at least 14 days without regressions and has the legal reviewer's sign-off for public release.

For: Everyone, for their own use

Gate

  • Everything required for Release Candidate, re-run on the exact Release Candidate commit
  • At least 14 days in Release Candidate
  • The AI legal reviewer's sign-off for public release

Release Candidate

Not Released Yet

A beta that is signed, has provenance and an SBOM, installs cleanly, and spent at least 7 days in beta.

For: Testers preparing to rely on it

Gate

  • Everything required for Beta, re-run on the exact Beta commit
  • At least 7 days in Beta
  • Installer test: a verified build installs and a tampered one is refused
  • The Beta release carries Sigstore signatures, build provenance and an SBOM

Beta

Not Released Yet

An alpha that passed the full lab, the legal review and at least 7 days without regressions.

For: Early testers on test machines

Gate

  • Everything required for Alpha, re-run on the exact Alpha commit
  • At least 7 days in Alpha
  • An AI legal review recorded for the Alpha build being promoted, with no open High legal risk

Alpha

Released

v0.1.0-alpha.6

2026-10-15 · commit e8fbd0343f26

Every change that passes CI. Incomplete and may be wrong; for testing the project itself.

For: Contributors and AI Cybersecurity Engineers

Gate

  • CI green: format, vet, race tests, static analysis, security and vulnerability scans
  • Lab proof: every check fails on the vulnerable lab and passes on the hardened lab
  • A new build since the last Alpha

Where OpenVAPT Stands

There is no Stable release yet. Every build is a pre-release: it may be incomplete or wrong, so use it only on test machines, 100% at your own risk. Alpha, Beta and Release Candidate builds, their gates and their evidence are all public on this page, in the open.
ItemValue
Most Mature ChannelAlpha
Next Stable Versionv0.1.0
Legal Review RecordUnreleased, reviewed 2026-10-14 by AI legal reviewer (Claude Opus 5.5 sub-agent, fresh context; an AI system, not a human lawyer); open High legal risks: 0; High risks accepted by the owner, not closed: 2

How a Build Is Promoted

1
Plan

Every day the promote workflow finds the most mature channel whose history, time and legal gates pass, and the exact commit that would move up.

2
Verify

That exact commit runs the full CI suite, the lab proof and the installer test again. Nothing tested on another commit counts.

3
Release

The build is published with checksums, Sigstore signatures, build provenance and an SBOM. Alpha, Beta and Release Candidate are marked pre-release.

4
Record

Every gate is checked once more with the real evidence, and the promotion is appended to the public record. Records are never edited.

Gate logic: internal/channels/channels.go. Workflow: .github/workflows/promote.yml. Record: release/channels.json.

Promotion History

DateChannelVersionCommitEvidence
2026-10-15Alphav0.1.0-alpha.6e8fbd0343f26CI Green: format, vet, race tests, static analysis, security and vulnerability scans
Lab Proof: every check fails on the vulnerable lab and passes on the hardened lab
2026-10-14Alphav0.1.0-alpha.5a2e2d702715aCI Green: format, vet, race tests, static analysis, security and vulnerability scans
Lab Proof: every check fails on the vulnerable lab and passes on the hardened lab
2026-10-14Alphav0.1.0-alpha.412bdadd31748CI Green: format, vet, race tests, static analysis, security and vulnerability scans
Lab Proof: every check fails on the vulnerable lab and passes on the hardened lab
2026-10-14Alphav0.1.0-alpha.367259ac74258CI Green: format, vet, race tests, static analysis, security and vulnerability scans
Lab Proof: every check fails on the vulnerable lab and passes on the hardened lab
2026-10-13Alphav0.1.0-alpha.212791243df48CI Green: format, vet, race tests, static analysis, security and vulnerability scans
Lab Proof: every check fails on the vulnerable lab and passes on the hardened lab
2026-10-13Alphav0.1.0-alpha.12e53a7d52fa9CI Green: format, vet, race tests, static analysis, security and vulnerability scans
Lab Proof: every check fails on the vulnerable lab and passes on the hardened lab

Choosing a Channel

Use Stable once it exists. Use Release Candidate, Beta or Alpha only on test machines, to help find problems before Stable. The installer picks Stable by default; see Download for every channel's install command. openvapt version prints the channel of the build you run, and every report records it.

Cite This Work: OpenVAPT. (2026). OpenVAPT: An open academic vulnerability assessment tool (Version 0.1.0-alpha.6) [Computer software]. https://github.com/OpenVAPT/openvapt