Acceptable Use Policy

This is the current published version. The version that travels with your copy of OpenVAPT governs that copy (licence sections 12 and 15; EULA section 27). Earlier versions are in the public Git history.

Version 1.6, effective 2026-10-14. Drafted by an AI Cybersecurity Engineer and reviewed by a separate AI system acting as the project's legal reviewer; no human lawyer drafted or reviewed it.

OpenVAPT is for academic, learning and Own Use only. It is not a business and must never be used to provide services.

Allowed

• Reading, studying and discussing the source code and documentation.
• Downloading OpenVAPT to your own server and running it there for personal testing and learning.
• Running OpenVAPT to test your own company's servers, on machines your company owns or controls and has authorised you to assess.
• Users under 18 may use OpenVAPT only after a parent or guardian has accepted the EULA for them, in the parent's or guardian's own name (EULA section 5).
• Running openvapt demo against the simulated lab for your own learning.
• Teaching under the Teaching With OpenVAPT terms (TEACHING.md): the simulated lab, the website Academy, supervised use on institution machines and virtual machines that are authorised and isolated, adapted teaching materials with attribution and notices, online and recorded classes, and free assessment, projects and capture-the-flag exercises on those machines. Each student accepts the EULA personally, or through a parent or guardian if under 18.
• Using pre-release builds (alpha, beta, rc), which may be wrong or unstable, only at your own risk and preferably on a non-production machine.
• Modifying the code for your own learning or own use, and contributing improvements back.

Not Allowed

• Running OpenVAPT on any machine that you or your employer do not own or control, including a client's or customer's machine, even with their permission, or on your employer's machine without your employer's authorisation.
• Modifying OpenVAPT, or reusing its code, to examine, access, attack or disrupt systems you are not authorised to examine, including removing or weakening the scope guard for that purpose.
• Providing any service to anyone else with OpenVAPT or with anything from or produced by it, paid or unpaid, such as vulnerability assessments, penetration tests, audits, scanning for clients, security consulting, a hosted or managed service, or selling or supplying reports.
• Selling, renting or licensing OpenVAPT, or including it in a product, platform or service for others.
• Presenting OpenVAPT reports as a certification, a professional penetration test, or an endorsement by OpenVAPT, or calling a modified version OpenVAPT without clearly saying it is modified.
• Running OpenVAPT on students' machines for them, accepting the terms for students, or using OpenVAPT in commercial training, paid public bootcamps, fee-paying certification courses or training for another organisation's staff.
• Using OpenVAPT in breach of any law.

Consequences

This policy is a condition of the OpenVAPT Source-Available Licence 1.3. Using OpenVAPT outside this policy is outside your licence, which then ends automatically as described in section 6 of the licence. You alone are responsible for any consequences.