OpenVAPTFrequently Asked Questions
OpenVAPT is a free, academic, non-commercial vulnerability assessment learning tool for Linux servers, with source-available code built by AI Cybersecurity Engineers. Here are short, factual answers to the questions people ask most.
What Is OpenVAPT?
OpenVAPT is a free, academic, non-commercial vulnerability assessment (VA) learning tool for Linux servers, with source-available code on GitHub, researched, developed and built entirely by AI Cybersecurity Engineers under human direction. It runs read-only checks on the machine it is installed on to identify weaknesses in the server, its network exposure and its websites, rates each finding with CVSS v3.1, proposes a fix with cited sources, and writes a local report. It is made for learning how a vulnerability assessment tool works.
Is OpenVAPT a Free VAPT Tool?
Yes. OpenVAPT is free to download and use, with no paid tier, no account and no licence key. It covers the vulnerability assessment (VA) part of VAPT. It does not perform penetration testing (PT): it never exploits or attacks anything.
Is OpenVAPT Open Source?
Every line of OpenVAPT's code is public on GitHub at github.com/OpenVAPT/openvapt to read, study and review. It is licensed only under the OpenVAPT Source-Available Licence 1.3, which permits reading and studying the code and using it for your own use, but does not license selling it or providing any service with it, paid or unpaid. It is therefore source-available, not open source under the Open Source Initiative definition.
Who Can Use OpenVAPT, and in Which Countries?
Anyone, in any country. OpenVAPT is offered worldwide, free of charge, to individuals, students, teachers, schools, universities and organisations, for their own use on machines they own or control. There is no regional version and no country restriction in the software or the licence. Each user remains responsible for the sanctions and export control laws that apply to them, and must follow the laws of the country where they and the machine are, including computer misuse and data protection laws. The licence and End User Licence Agreement are governed by Malaysian law only because that is where the licensor is; this does not limit who may use OpenVAPT, and it does not remove protections that the mandatory law of a user's own country gives them.
Can I Use OpenVAPT for My Company's Servers?
Yes, for your own use. Individuals and organisations, including companies, may run OpenVAPT free of charge on computers and servers they own or control, to learn and to assess those same machines. OpenVAPT itself is an academic project, not a business, and it may not be used to provide services to anyone else, including on a client's server even with their permission.
Can I Use OpenVAPT to Offer VAPT or Security Services to Clients?
No. OpenVAPT may not be sold, included in a product, or used to provide vulnerability assessment, penetration testing, auditing, scanning or any other service to anyone else, paid or unpaid. It is for academic, learning and own use only.
Can OpenVAPT Scan Other Servers or Websites?
No. OpenVAPT only assesses the machine it runs on. Every network connection is restricted in code to loopback addresses (127.0.0.0/8 and ::1), and host names are not resolved, so it is designed so that it cannot be pointed at another server, network or website. Users must still have the right to run it on the machine where they run it.
Is OpenVAPT a Penetration Test?
No. OpenVAPT is an automated, non-intrusive vulnerability assessment following the Planning, Discovery and Reporting phases of the four-phase methodology in NIST SP 800-115 (Planning, Discovery, Attack, Reporting), without the Attack phase. It contains no exploit code. A report without findings does not prove a system is secure.
What Does OpenVAPT Check?
OpenVAPT runs 310 read-only checks: 168 for the server (OS support and patches, SSH including forwarding and authentication methods, accounts, sudo, file permissions, SUID, cron, kernel hardening, systemd service hardening, containers, logging, auditing, time sync), 50 for the network (listening services, database, cache, file-share, DNS and mail service configuration, exposed admin and application server ports, host and IPv6 firewalls, firewall rules compared with listening services, Docker firewall bypass, TLS versions, ciphers, keys and certificates) and 92 for web apps (security headers, cookies, HTTPS redirect, exposed .git, .env and backups, phpinfo, directory listing, status pages, PHP settings, Apache Tomcat, Node.js and Python (Django and Flask) settings, and WordPress, Joomla and Drupal hardening).
Which Standards Does OpenVAPT Follow?
OpenVAPT follows NIST SP 800-115 for methodology, rates severity with CVSS v3.1, and maps checks to the OWASP Top 10 (2021), OWASP ASVS 4.0.3, CWE and NIST SP 800-53 Rev. 5. Reports are available in HTML, JSON, SARIF 2.1.0 and Markdown.
Does OpenVAPT Collect Any Data?
No. The OpenVAPT tool is designed to make no connection to any other machine and has no telemetry. The openvapt.com website sets no cookies, has no analytics, forms or accounts, and its server logs are turned off. Reports stay on the user's own machine.
Is OpenVAPT Safe to Run on a Production Server?
OpenVAPT is designed to be read-only: it reads files, runs a short allow-list of read-only commands and sends GET requests to local websites through 127.0.0.1, and it is designed not to change, install or restart anything. It may still contain mistakes and uses server resources, so it is provided as is and used 100% at your own risk; test it on a non-production machine first and preview every action with openvapt scan --dry-run.
How Is OpenVAPT Different from Lynis, OpenSCAP, OpenVAS, Nuclei or OWASP ZAP?
OpenVAPT is primarily a teaching project: every check is documented and cited to its exact source code, and it combines server, network-exposure and local website checks in one read-only binary that can only assess its own machine. Mature tools such as Lynis and OpenSCAP (host hardening), OpenVAS (network vulnerability scanning), Nuclei (template-based scanning) and OWASP ZAP (web application testing) are broader and better suited to professional work. OpenVAPT is not affiliated with, sponsored or endorsed by any of these projects or their owners; their names are used only to identify them.
Who Made OpenVAPT? Was It Built by AI Cybersecurity Engineers?
Yes. All of OpenVAPT, including its code, tests, documentation, website, course and legal drafts, was researched, developed and built by AI Cybersecurity Engineers: Claude (Anthropic) through Claude Code produced the work, and OpenAI Codex reviewed the code, proposed and implemented fixes, and built parts of the code to Claude's specification (network, data-service and TLS checks, the report redesign and the vulnerability matching engine), each reviewed by Claude before merging. AI Cybersecurity Engineers are AI systems (Claude by Anthropic, through Claude Code, and OpenAI Codex) acting in a cyber security engineering role. They are not people, not registered or professional engineers, and provide no professional engineering or security service. OpenVAPT's human project owner directs the work, makes every decision and approves what is published, but did not hand-write the code. It has not been audited by an independent human security expert, and the legal documents were reviewed by an AI legal reviewer, not by a human lawyer. The full history is public on GitHub.
Can I Learn VAPT with OpenVAPT?
Yes. The OpenVAPT Academy is a free course of 36 modules that goes from security basics, VAPT methodology, CVE, CWE and CVSS, through Linux, SSH, network, TLS, web security, systemd service hardening, firewall policy, application servers (Tomcat, Node.js, Python), CMS hardening, access control and logging, to running an assessment, fixing and verifying findings, reporting and building your own check. Each module links theory to the real OpenVAPT checks and includes a hands-on lab and a self-check quiz.
How Do I Install OpenVAPT?
Build it from source with Go (recommended for transparency), or run the one-command installer: curl -fsSL https://raw.githubusercontent.com/OpenVAPT/openvapt/main/scripts/install.sh | sh . The optional installer, hosted on GitHub and run at your own risk, picks the most stable release channel that has a release and warns when that is a pre-release, downloads the Linux binary for your CPU from GitHub Releases over HTTPS, is designed to refuse to install it unless its SHA-256 checksum matches, verifies its Sigstore signature when cosign is installed, and installs it without root. By default it scans nothing (Download Only); adding --run scans straight after installing (Download and Scan), which still requires you to type I ACCEPT.
Can I Download Without Scanning?
Yes. Download Only is the installer's default: curl -fsSL https://raw.githubusercontent.com/OpenVAPT/openvapt/main/scripts/install.sh | sh installs and verifies OpenVAPT and scans nothing. It then prints the next steps: openvapt scan --dry-run to preview every file, command and request a scan would use, and sudo openvapt scan to scan later. You can also download the binary, SHA256SUMS and the Sigstore bundle from GitHub Releases and verify them yourself, as the download page shows, or build from source.
How Do I Scan Straight After Downloading?
Add --run to the installer: curl -fsSL https://raw.githubusercontent.com/OpenVAPT/openvapt/main/scripts/install.sh | sh -s -- --run . After installing and verifying, it starts a read-only scan of the same machine in your terminal. The scan shows the acknowledgements and continues only when you type I ACCEPT on the terminal; the installer never accepts for you and refuses to scan without a terminal. It writes HTML, JSON, SARIF and Markdown reports, signed with your local key, to a new private folder ~/openvapt-reports/ named after the UTC time (or --out DIR), then prints the severity summary, the exit code, every report path and how to open the HTML report. Add --sudo to run only the scan with sudo for full coverage. A scan usually takes one to five minutes and is a self-assessment, not a penetration test.
Is OpenVAPT Free for Students and Teachers?
Yes. OpenVAPT is free for anyone. It includes a built-in simulated lab (openvapt demo) with a deliberately vulnerable server and a hardened server, so students can run a full simulated scan, read a report and compare the fixes on any computer, without scanning a real machine. Teaching is governed by the Teaching With OpenVAPT terms (TEACHING.md).
Can Teachers Use OpenVAPT in Class?
Yes, free of charge, under the Teaching With OpenVAPT terms. Schools, colleges, universities (including those charging ordinary tuition), government training academies and organisations training their own staff may teach with it. Teachers may adapt and translate the Academy modules, quizzes and course plans into their own slides and learning systems with attribution and the required notices; teach online, live or recorded; and use it for grading, projects and capture-the-flag exercises on the simulated lab or on lab machines and virtual machines the institution owns, has authorised and has isolated. Each student accepts the terms personally, or through a parent or guardian if under 18. A student may run it on a computer the student personally owns or controls only as that student's own Own Use, never as a class requirement. Commercial training providers, paid public bootcamps, fee-paying certification courses, training another organisation's staff and any class scan of a machine the institution does not own or control are not allowed. Practice lab answer keys can be printed by any student, so they suit learning exercises rather than secure exams. OpenVAPT is pre-release and used 100% at your own risk.
How Do I Cite OpenVAPT?
Press Cite at the top or bottom of any page of openvapt.com for APA, IEEE, Harvard, MLA, Chicago and BibTeX with Copy buttons and .bib, .ris, CITATION.cff and CSL-JSON downloads, or run openvapt cite (for example openvapt cite --format bibtex) to print the citation for your exact version. Every report also ends with a How to Cite block. The author is the group author OpenVAPT, with no personal names, and OpenVAPT has no DOI yet. Citing is requested whenever OpenVAPT helped your work, and credit is required by section 5.4 of the licence when you copy or share its material.