Licence

This is the current published version. The version that travels with your copy of OpenVAPT governs that copy (licence sections 12 and 15; EULA section 27). Earlier versions are in the public Git history.

Version 2.3, effective 2026-10-14. Drafted by an AI Cybersecurity Engineer and reviewed by a separate AI system acting as the project's legal reviewer; no human lawyer drafted or reviewed it. This page summarises the licence; the file LICENSE is the legal text and prevails.

In Short

OpenVAPT is academic, non-commercial, open, source-available code built by AI Cybersecurity Engineers, free to download and use, for your own personal or business use, 100% at your own risk.

• Free for anyone to download, read, study, modify and run, including companies.
• Own use only: download it to your own server for personal testing, or use it to test your own company's servers with your company's authorisation.
• No services, no selling, no Commercial Exploitation: you may not sell it, put it in a product, or provide any service to others with anything from or produced by OpenVAPT (no consulting, no scanning for clients, no hosted service, no reselling reports), paid or unpaid.
• Not a business: the project sells nothing and accepts no payments or donations.
• Credit us, cite us: if you copy, quote, adapt or present any OpenVAPT material, you must credit OpenVAPT; and we ask everyone to cite OpenVAPT in papers, theses, coursework, presentations and projects it helped (see CITING.md).
• Your risk: it comes as is, with no warranty, and the developers are not liable for anything, to the fullest extent the law allows.

The Licence Text

OpenVAPT is licensed only under the OpenVAPT Source-Available Licence 1.3 (file LICENSE, identifier LicenseRef-OpenVAPT-SAL-1.3). The licence itself grants only these permissions: to read, study and quote the code; to download, build and run it for Own Use; to modify it for Own Use or to contribute back; to teach with it under the Teaching With OpenVAPT terms (TEACHING.md), including adapting its course material free of charge; and to share complete copies free of charge with the licence and terms attached. Everything else is not licensed. In particular, providing any service with OpenVAPT or its output, paid or unpaid, is not licensed for anyone, including charities, schools and government bodies.

The End User Licence Agreement (EULA) and Acceptable Use Policy are conditions of the licence, so breaking them also ends the licence.

Credit and Citation

The licence has two layers on attribution.

1. Required Credit (licence section 5.4). Whenever you copy, quote, share, translate, adapt or present any OpenVAPT Material (code, documentation, Academy modules, worksheets, check descriptions, report templates, website text, figures or screenshots), in any medium, you must credit OpenVAPT: name "OpenVAPT", give openvapt.com or the GitHub address, give the version where you know it, and say if you adapted it. Any normal academic citation does this. Credit may be given in any reasonable way for the medium, and at the first practical place where it does not fit at the point of use. It must not suggest endorsement.
2. Requested citation. For running the tool, reporting its results, or using ideas and knowledge learned from it, no Credit is legally required, because copyright does not protect ideas, facts or methods and a licence cannot change fair dealing under the Copyright Act 1987. We still ask you to cite OpenVAPT, and academic integrity rules usually require it.

Ready-to-copy citations in every common style are in CITING.md; CITATION.cff is the machine-readable form.

Earlier Licence

Before its public release, the repository carried the PolyForm Noncommercial License 1.0.0 with an OpenVAPT Additional Permission. No release was published under those terms. They were replaced on 2026-10-13 by the OpenVAPT Source-Available Licence 1.0 so that the ban on services is part of the licence itself.

Licence Versions

Release v0.1.0-alpha.1 was published on 2026-10-13 under version 1.0 of the OpenVAPT Source-Available Licence, and the source archive of that release carries its text. Version 1.1 then widened the Teaching permission by adding the Teaching With OpenVAPT terms (TEACHING.md), with their teaching conditions, and left every other term unchanged. Version 1.2 added the Credit condition and the definitions of OpenVAPT Material and Credit, required CITING.md to travel with shared copies, and left every other term unchanged. Each copy is governed by the licence version provided with it (licence sections 12 and 15).

Why We Say Source-Available

The source code is fully public, for everyone to read and review, and you may modify it within the licence. The licence restricts use to Own Use, so OpenVAPT is not "open source" under the Open Source Initiative's definition. The accurate term is source-available. We use "open" on this website only in its plain sense: nothing about the code is hidden.

Third-Party Code

The compiled program contains OpenVAPT's own code, the Go standard library (BSD 3-Clause licence) and, in release builds, an embedded snapshot of public vulnerability advisory data (OSV ecosystem exports and the CISA Known Exploited Vulnerabilities catalogue). The advisory data belongs to its publishers and is used under their terms, listed in THIRD_PARTY_NOTICES.md; the snapshot in the source repository is a small test fixture. The website also uses self-hosted copies of AG Grid Community (MIT), Apache ECharts (Apache-2.0), Lucide icons (ISC) and the IBM Plex fonts (SIL Open Font License 1.1). Each component's own licence applies to that component and is listed in THIRD_PARTY_NOTICES.md. Every source and tool used is credited in CREDITS.md.

Built by AI Cybersecurity Engineers, and Copyright

All of OpenVAPT was researched, developed and built by AI Cybersecurity Engineers under the direction of the project owner (see AI-DISCLOSURE.md). Copyright may not exist in some parts built by AI Cybersecurity Engineers under the laws of some countries. The licence applies to the extent that rights exist; the promises in the EULA apply to the whole Software regardless.

Contributions

By submitting a contribution you confirm, through the Developer Certificate of Origin sign-off, that you have the right to submit it; you license it to everyone under the OpenVAPT Source-Available Licence 1.3; you grant the licensor a perpetual licence to relicense it; and you authorise the licensor to accept the EULA's contributor protections on your behalf, as set out in section 10 of the licence. You keep your copyright. Disclose in your pull request if an AI Cybersecurity Engineer or other AI system produced any part of your contribution. Feedback and ideas shared in Issues or Discussions may be used freely, without payment or obligation.