Skip to Content
OpenVAPTAlpha
Cite
Pre-release. Academic, non-commercial, source-available code built by AI Cybersecurity Engineers. Free for your own use, 100% at your own risk. This website collects no data. Read MoreRead Less
Pre-release. OpenVAPT has no Stable release yet. Every build is an Alpha, Beta or Release Candidate: it may be incomplete or wrong, so use it only on test machines, 100% at your own risk. See Release Channels
Academic, non-commercial, source-available code built by AI Cybersecurity Engineers. These are AI systems, not people or registered engineers. Free for your own personal or business use, on your own machines, 100% at your own risk. Not for sale. Not for providing services. This website collects no data. Read the Acknowledgements
Pre-release. OpenVAPT has no Stable release yet. Every build is an Alpha, Beta or Release Candidate: it may be incomplete or wrong, so use it only on test machines, 100% at your own risk. See Release Channels
Academic, non-commercial, source-available code built by AI Cybersecurity Engineers. These are AI systems, not people or registered engineers. Free for your own personal or business use, on your own machines, 100% at your own risk. Not for sale. Not for providing services. This website collects no data. Read the Acknowledgements

What OpenVAPT Does Not Do

Limits are part of the design. Each one below is built into the code. Software can contain mistakes, so treat these as design goals, not guarantees, and read the code.

It Does NotWhyHow It Is Enforced
Scan any other machine, network or websiteYou may only assess machines you own or control, or that your employer owns or controls and has authorised you to assess. Scanning others without permission can be a crime in most countries (for example the Computer Fraud and Abuse Act in the United States, the Computer Misuse Act 1990 in the United Kingdom or the Computer Crimes Act 1997 in Malaysia).The scope guard refuses every non-loopback address before connecting. Host names are not resolved. See the code.
Exploit, attack or brute-force anythingIt is an assessment tool for learning, not an attack tool.No exploit code exists in the repository. Only fixed-path GET requests are sent.
Change your systemA scan is designed not to change a server.The System interface has no write, delete or restart operation. Commands come from a read-only allow-list.
Send any data anywhereYour weaknesses are your business.No telemetry, no update check, no upload code. Proxies are disabled. Reports are written to your disk with mode 0600.
Look up DNS records of your domainsDNS lookups would leave the machine.Not implemented, on purpose.
Replace a penetration test or code reviewLogic flaws such as SQL injection, broken access control or business rule errors need a human tester.Every report states this limitation.
Certify or approve anythingNo automated tool can prove a system is secure.No seal, badge or score is produced. Signatures prove only that a report was not edited.
Make pre-release builds reliableAlpha, beta and release candidate builds are unfinished and may be wrong or unstable.Each build is labelled with its channel. Pre-release builds are used 100% at your own risk.
Support Windows or macOS scansThe first version focuses on Linux servers.openvapt scan exits on other systems. openvapt demo works everywhere.

Cite This Work: OpenVAPT. (2026). OpenVAPT: An open academic vulnerability assessment tool (Version 0.1.0-alpha.6) [Computer software]. https://github.com/OpenVAPT/openvapt