OpenVAPTReview, Report and Contribute
Everything happens in the open on GitHub. There is no email address and no contact form: the repository is the only channel.
Report a Bug or False Result
Open an issue with the Bug, False Positive or False Negative template. Include the check id and the redacted evidence line, never secrets or full reports.
Ask or Discuss
Questions and academic discussion go to GitHub Discussions. There is no private support.
Security Flaw in OpenVAPT
Use GitHub Private Vulnerability Reporting. It is published as an advisory once fixed.
Pull Requests
- Every commit is signed off under the Developer Certificate of Origin (
git commit -s). No separate agreement is needed. - Contributions are licensed under the OpenVAPT Source-Available Licence 1.3, with a licence to the licensor to relicense them and to accept the EULA's contributor protections on their behalf (licence section 10). No payment or credit is owed.
- CI must pass: formatting, vet, staticcheck, gosec, govulncheck, unit tests and the lab tests.
- New checks need full documentation, at least one public reference and lab coverage. See Write Your Own Check.
Versions and Releases
- Semantic Versioning: MAJOR for breaking changes to the CLI or report schema, MINOR for new checks, PATCH for fixes.
- Conventional Commits feed the changelog.
- Releases are built only by GitHub Actions through the promotion workflow, after every release channel gate has passed, with SHA-256 checksums, Sigstore signatures, build provenance and a software bill of materials (SBOM). Each release is created as a draft and published only after every file is verified.
- Any fixes are voluntary and, if made, go only into the latest minor version. There is no obligation to fix anything.
- Each report records the tool version and commit it was produced with.