Skip to Content
OpenVAPTAlpha
Cite
Pre-release. Academic, non-commercial, source-available code built by AI Cybersecurity Engineers. Free for your own use, 100% at your own risk. This website collects no data. Read MoreRead Less
Pre-release. OpenVAPT has no Stable release yet. Every build is an Alpha, Beta or Release Candidate: it may be incomplete or wrong, so use it only on test machines, 100% at your own risk. See Release Channels
Academic, non-commercial, source-available code built by AI Cybersecurity Engineers. These are AI systems, not people or registered engineers. Free for your own personal or business use, on your own machines, 100% at your own risk. Not for sale. Not for providing services. This website collects no data. Read the Acknowledgements
Pre-release. OpenVAPT has no Stable release yet. Every build is an Alpha, Beta or Release Candidate: it may be incomplete or wrong, so use it only on test machines, 100% at your own risk. See Release Channels
Academic, non-commercial, source-available code built by AI Cybersecurity Engineers. These are AI systems, not people or registered engineers. Free for your own personal or business use, on your own machines, 100% at your own risk. Not for sale. Not for providing services. This website collects no data. Read the Acknowledgements

OpenVAPT Source-Available Licence 1.3

This is the current published version. The version that travels with your copy of OpenVAPT governs that copy (licence sections 12 and 15; EULA section 27). Earlier versions are in the public Git history.

Version 1.3, effective 2026-10-14. Identifier: LicenseRef-OpenVAPT-SAL-1.3. Version history is in section 15.

This licence was drafted by an AI Cybersecurity Engineer and reviewed by a separate AI system acting as the project's legal reviewer. No human lawyer drafted or reviewed it. It is not legal advice to anyone.

1. Acceptance

You may use the Software only under this licence. To get any permission under it, you must accept every term below as both a promise and a condition of that permission. If you do not accept, you have no permission at all, apart from any right the law gives you that this licence cannot take away (section 13).

2. Definitions

Licensor means the individual who owns and runs the OpenVAPT project and publishes it under the name "OpenVAPT", and any person to whom that individual transfers the project. "OpenVAPT" is a project name, not a company or other legal entity.

Software means OpenVAPT as made available by the Licensor under this licence, including its source code, compiled programs, tests, documentation, course material and website, and any part or modified version of it.

You means the individual who accepts this licence and, where that individual acts for an organisation, that organisation.

Your Organisation means the company or other organisation you work for or act for, if any.

Own Use means (a) running the Software on computers and servers that you own or control, to test and learn about those same machines, for your own personal purposes; or (b) running the Software on computers and servers that Your Organisation owns or controls, to test those same machines for Your Organisation's own internal purposes, where Your Organisation has authorised you to do so.

Service means any activity done for, or made available to, any person other than you or Your Organisation, whether paid or unpaid, including vulnerability assessment, penetration testing, auditing, scanning, consulting, training delivered as a service, and any hosted, managed or outsourced service. Teaching is not a Service.

Teaching means teaching that is permitted by, and done in line with, the Teaching With OpenVAPT terms (TEACHING.md) provided with the Software, which form part of this licence. In summary: teaching by educational institutions (including those charging ordinary tuition), government training academies, organisations training their own staff, and free individual teachers; using the simulated lab, the website Academy, and machines and virtual machines the institution owns or controls and has authorised, under supervision; and adapting the teaching materials free of charge with attribution and notices. Teaching never includes commercial training providers, paid bootcamps or courses sold to the public, fee-paying certification courses, training another organisation's staff, any fee charged specifically for the Software, or running the Software, as part of Teaching, on any machine the institution does not own or control. A student who runs the Software on a computer that the student personally owns or controls does so as that student's own Own Use, under that student's own acceptance of this licence and the EULA, and not as Teaching.

Output means anything produced by the Software, including reports, findings, scores and signed reports.

OpenVAPT Material means any part of the Software that is protected by copyright, including its source code, documentation, Academy modules, quizzes, worksheets, rubrics, course plans, glossary, check descriptions, report templates, website text, figures, diagrams and screenshots.

Credit means a statement, given as set out in section 5.4, that identifies OpenVAPT as the source of OpenVAPT Material. The recommended forms are in CITING.md.

3. What You May Do

The Licensor grants you a non-exclusive, worldwide, royalty-free, non-transferable and non-sublicensable copyright licence, and a licence under any patent rights the Licensor can license, to do the following, and only the following:

  1. Read and study. Read, study, review and discuss the source code and documentation, and quote reasonable extracts of them, with Credit (section 5.4), in teaching, study, research and academic writing.
  2. Own Use. Download, copy, build, install and run the Software for Own Use only.
  3. Modify. Modify the Software for Own Use, or to propose a contribution back to the OpenVAPT project.
  4. Share copies free of charge. Give complete copies of the Software, modified or unmodified, to others free of charge, but only if (a) you include this licence, the NOTICE file, the End User Licence Agreement (EULA.md), the Disclaimer (DISCLAIMER.md), the Acceptable Use Policy (ACCEPTABLE_USE.md), TEACHING.md and CITING.md unchanged; (b) you clearly mark any modified version as modified and do not call it OpenVAPT without saying so; and (c) you charge nothing, and receive no other benefit, for the copies or for anything connected with them. Each recipient gets permission only from the Licensor, under this licence, and not from you.
  5. Teaching. Use the Software for Teaching, including copying, adapting and translating its course material into your own teaching materials for your own students free of charge, as set out in TEACHING.md. Each student who downloads or runs the Software must accept this licence and the EULA personally, or through a parent or guardian if under 18.

4. What Is Not Licensed

Everything not expressly allowed in section 3 is not licensed. In particular, nobody, including individuals, charities, educational institutions, research bodies and government bodies, is licensed to:

  1. use the Software, or any Output, to provide any Service to anyone, paid or unpaid, even with that person's permission, including running the Software on a machine belonging to a client, customer or any other third party;
  2. sell, rent, lease or license the Software or copies of it, or charge for it or for access to it;
  3. include the Software, or any part or modified version of it, in any product, platform or service offered to others;
  4. sell, supply or present any Output to others as a service, certification, audit or professional assessment;
  5. use the Software, or any part of it, to examine, access, attack or disrupt any system that you are not authorised to examine, or remove or weaken its scope guard for that purpose; or
  6. use the Software in any other way that earns money, or any other benefit, from the Software itself.

5. Conditions

  1. You must accept and follow the End User Licence Agreement (EULA.md) and the Acceptable Use Policy (ACCEPTABLE_USE.md). Breaking either of them is outside this licence.
  2. You must keep every copyright notice, the NOTICE file and every line beginning with Required Notice: in every copy.
  3. You alone are responsible for having the legal right to run the Software on any machine, and for complying with every law that applies to you.
  4. Credit. Whenever you copy, quote, share, translate, adapt or present any OpenVAPT Material, in whole or in part, in any medium (including a research paper, thesis, dissertation, coursework, assignment, presentation, poster, academic project, teaching material, book, article, blog post, video or software), you must give Credit, as follows:
  5. Credit must name "OpenVAPT", give the web address https://openvapt.com or https://github.com/OpenVAPT/openvapt, and, where you know it, the version used. Where you adapted or translated the material, Credit must say so. Any citation in a recognised academic style that contains these items is sufficient Credit. Recommended wording for every common style is in CITING.md.
  6. Credit may be given in any manner that is reasonable for the medium and context: for example in the reference list of a paper or thesis, on a slide or in the speaker notes of a presentation, in the caption or footer of a poster or figure, in a comment at the top of a source file, or spoken aloud where nothing is written.
  7. Where it is genuinely impractical to give Credit at the point of use (for example a very short verbal mention), you must give it at the first practical place, such as the reference list, the description or the accompanying materials.
  8. Credit must not suggest that OpenVAPT or anyone connected with it sponsors, endorses, approves or has reviewed your work.
  9. You need not give Credit only for running the Software for Own Use, for private notes you keep to yourself, or for using ideas, facts, methods or knowledge you learned from OpenVAPT without copying its expression. The Licensor nevertheless asks you to cite OpenVAPT in those cases too, as CITING.md explains; that request is not a condition of this licence.
  10. If the Licensor asks you in writing to remove a Credit from a modified version, you must remove it as far as is reasonably practicable.

6. Termination

Your permissions end automatically and immediately if you break any term of this licence, the EULA or the Acceptable Use Policy. The Licensor may, but need not, reinstate them in writing. When your permissions end you must stop using the Software and delete every copy you control. Sections 4 and 7 to 14 continue after termination.

7. A Free Gift With No Duty

The Software is given free of charge, as a gift, by a person who is not in business, does not trade, sells nothing and accepts no payment or donation. No consideration is paid to the Licensor or any contributor. Giving the Software creates no relationship of supplier and consumer, agency, partnership, employment, advice, professional service or any other relationship, and no duty of care, support, maintenance, update, correction or response.

8. No Warranty

Builds published on the alpha, beta and release candidate (rc) channels are pre-release: unfinished, possibly wrong or unstable, and used 100% at your own risk. To the fullest extent permitted by law, the Software, every build on every channel and every Output are provided "as is", with all faults, and without any warranty, guarantee, condition or representation of any kind, express, implied or statutory, including as to quality, fitness for any purpose, accuracy, completeness, security, availability or non-infringement.

9. No Liability

To the fullest extent permitted by law, neither the Licensor nor any contributor is liable to you or anyone else for any loss or damage of any kind, however caused and under any legal theory (including contract, tort, negligence and breach of statutory duty), arising from or connected with the Software, any Output or this licence. Where liability cannot lawfully be excluded, it is limited to the smallest amount the law permits.

10. Contributions

By submitting a contribution to the OpenVAPT project, you (a) confirm through the Developer Certificate of Origin sign-off that you have the right to submit it; (b) license it to everyone under this licence; and (c) grant the Licensor a perpetual, irrevocable, worldwide, royalty-free licence to use, copy, modify, distribute, sublicense and relicense it under any terms, so that the project can be maintained, relicensed or transferred; and (d) authorise the Licensor to accept, as your agent, the protections that the EULA gives to contributors (its sections 12 to 15), so that you may rely on them. You keep your copyright. No payment or credit is owed for any contribution.

11. Built by AI Cybersecurity Engineers

The Software was researched, developed and built by AI Cybersecurity Engineers under the direction of the Licensor. Copyright may not exist in some parts under the laws of some countries. This licence applies to the extent that rights exist. Your promises in the EULA apply to all of the Software regardless.

12. Changes to This Licence

The Licensor may publish new versions of this licence. Each copy of the Software is governed by the version provided with it. The Licensor may also offer the Software under other terms.

13. Rights the Law Gives You

Nothing in this licence limits any right that the law gives you and that cannot be limited by agreement. Nor does this licence seek to restrict fair dealing, fair use or a similar exception under the copyright law of your country (for example fair dealing under the Copyright Act 1987 in Malaysia or the Copyright, Designs and Patents Act 1988 in the United Kingdom, or fair use under section 107 of the United States Copyright Act).

14. Governing Law and Severability

This licence is offered to anyone, in any country. Malaysian law governs it only because that is where the Licensor is; that choice does not limit who may use OpenVAPT and does not remove any protection the mandatory law of your country gives you. This licence is governed by the laws of Malaysia, and the courts of Malaysia have exclusive jurisdiction, subject only to any right the law of your country gives you that cannot be excluded. If any part of this licence is invalid or unenforceable anywhere, it is read down to the minimum extent needed to make it enforceable there, or, if that is not possible, removed there, and the rest stays in full force. A permission that is removed is not replaced by a wider one.

15. Version History

  1. Version 1.0 (2026-10-13, commit 529d69c) was the first version. Release v0.1.0-alpha.1 was published under it, and the source archive of that release contains its text, which continues to govern copies obtained from that release (section 12).
  2. Version 1.1 (2026-10-13, commit 0b7c64b) widens the Teaching permission by adding the Teaching With OpenVAPT terms (TEACHING.md): more kinds of teachers, institution virtual machines, and free adaptation of course material. It also adds teaching conditions: TEACHING.md must travel with shared copies, and students under 18 need a parent's or guardian's acceptance. Every other term is unchanged. Anyone holding a version 1.0 copy may instead choose to use that copy under version 1.1 by accepting all of its terms.
  3. Version 1.2 (2026-10-13, commit 09eac2b) adds the definitions of OpenVAPT Material and Credit and a Credit condition (section 5.4): anyone who copies, quotes, shares, adapts or presents OpenVAPT Material must credit OpenVAPT in a reasonable manner, with recommended citations in CITING.md, and CITING.md must travel with shared copies (section 3.4). Using ideas and facts, and running the Software for Own Use, need no Credit, though citation is requested. Every other term is unchanged. Anyone holding a version 1.0 or 1.1 copy may instead choose to use that copy under version 1.2 by accepting all of its terms.
  4. Version 1.3 (2026-10-14) adds the Disclaimer (DISCLAIMER.md) to the documents that must travel with shared copies (section 3.4), and adds section 10(d), by which contributors authorise the Licensor to accept on their behalf the protections the EULA gives them. Every other term is unchanged. The commit that introduced each version is named above; for version 1.3 it is the first commit on the main branch whose LICENSE file states this version (see the history of the LICENSE file in Git). Anyone holding an earlier copy may instead choose to use that copy under version 1.3 by accepting all of its terms. Before any release carried it, version 1.3 was clarified on 2026-10-14 to state that the licence is offered to anyone in any country (section 14) and to name fair dealing and fair use under the user's own copyright law (section 13); no right or condition changed.

Required Notice: Copyright (c) 2026 OpenVAPT and contributors. Licensed under the OpenVAPT Source-Available Licence 1.3 (LicenseRef-OpenVAPT-SAL-1.3). Own Use only; no services, no selling. Credit and cite OpenVAPT when you use its material (CITING.md).

Cite This Work: OpenVAPT. (2026). OpenVAPT: An open academic vulnerability assessment tool (Version 0.1.0-alpha.6) [Computer software]. https://github.com/OpenVAPT/openvapt