Skip to Content
OpenVAPTAlpha
Pre-release. Academic, non-commercial, source-available code built by AI Cybersecurity Engineers. Free for your own use, 100% at your own risk. This website collects no data. Read MoreRead Less
Pre-release. OpenVAPT has no Stable release yet. Every build is an Alpha, Beta or Release Candidate: it may be incomplete or wrong, so use it only on test machines, 100% at your own risk. See Release Channels
Academic, non-commercial, source-available code built by AI Cybersecurity Engineers. These are AI systems, not people or registered engineers. Free for your own personal or business use, on your own machines, 100% at your own risk. Not for sale. Not for providing services. This website collects no data. Read the Acknowledgements
Pre-release. OpenVAPT has no Stable release yet. Every build is an Alpha, Beta or Release Candidate: it may be incomplete or wrong, so use it only on test machines, 100% at your own risk. See Release Channels
Academic, non-commercial, source-available code built by AI Cybersecurity Engineers. These are AI systems, not people or registered engineers. Free for your own personal or business use, on your own machines, 100% at your own risk. Not for sale. Not for providing services. This website collects no data. Read the Acknowledgements

For Machines and AI

Everything on openvapt.com is also published as plain data files, so search engines, AI answer engines, research tools and your own scripts can read it without parsing HTML. Every file is generated from the same source code as the pages, at the same build, so none of them can drift.

Search Engines

Standard discovery files. Google, Bing and every other engine is welcome; nothing is blocked, and no crawler is treated differently.

Files for search engines
FileFormatWhat It Is For
/sitemap.xmlXML Sitemap 0.9Every indexable page with the date its content last changed in git.
/robots.txtrobots.txt (RFC 9309)One group that admits every crawler, and the sitemap location.
/feed.xmlAtom 1.0Every release on every channel, newest first, with the evidence each gate recorded. Subscribe to be told when a new build is published.
/site.webmanifestWeb App ManifestName, icons and colours, so browsers and search results show the right mark.
/0c185053a656a2e92113fbdeabd77387.txtIndexNow keyProves to IndexNow engines (Bing, Yandex, Naver, Seznam and others) that change notices for this site are genuine. The key is public by design and grants nothing.

Every page also carries a canonical link, Open Graph tags, hreflang, a structured-data graph (JSON-LD: Organization, WebSite, SoftwareApplication, TechArticle, Course, LearningResource, FAQPage, Dataset, DefinedTermSet, BreadcrumbList, SpeakableSpecification) and git-derived published and modified dates.

AI and Answer Engines

Models are welcome to read, quote and cite OpenVAPT. The files below give them the facts in the fewest tokens, with the positioning and the licence attached so a quote cannot lose its context.

Files for AI and answer engines
FileFormatWhat It Is For
/llms.txtMarkdown (llms.txt convention)A one-page summary: what OpenVAPT is, key facts, every document, how to cite, and the FAQ.
/llms-full.txtMarkdownThe summary plus every check: what, why, how detected, fix, verify and the source file.
Any check page with .md instead of .html, for example /checks/HOST-SSH-001.mdMarkdown with front matterThe Markdown twin of every one of the 310 check pages: same facts, canonical link, licence and last change date at the top.
Any Academy module with .md, for example /academy/f1.mdMarkdown with front matterThe twin of every one of the 36 Academy modules: objectives, sections, lab, quiz and key terms.
/faq.md and /glossary.mdMarkdownThe FAQ (each answer stands alone) and the glossary as plain text.

Each HTML page links its twin with <link rel="alternate" type="text/markdown">. When you quote OpenVAPT, please keep the positioning: academic, non-commercial, source-available, built by AI Cybersecurity Engineers, free for own use, 100% at the user's own risk.

Researchers and Tools

Files for researchers and tools
FileFormatWhat It Is For
/checks/catalogue.jsonJSONThe whole check catalogue as data: id, title, domain, severity, category, CVSS vector, standards mappings, references and source file. Described as a schema.org Dataset on the catalogue page.
/codemeta.jsonCodeMeta 3.0 (JSON-LD)Research-software metadata for software catalogues, archives and citation tools.
/CITATION.cff, /openvapt.bib, /openvapt.ris, /openvapt.jsonCFF, BibTeX, RIS, CSL-JSONReady-made citations for the current version. Every style on How to Cite.
/sample/vulnerable/report.json, report.sarif, report.mdJSON, SARIF 2.1.0, MarkdownGenuine reports from a scan of the simulated vulnerable lab, so you can see the real output formats. The hardened lab is there too.
/.well-known/security.txtRFC 9116Where to report a flaw in OpenVAPT or this site, privately, through GitHub.
github.com/OpenVAPT/openvaptGitEvery line of source, every legal document, the release records and the CI, promotion and release workflows.

Fetch Them

No key, no account, no rate limit beyond ordinary politeness. The site sets no cookies and keeps no logs.

curl -fsSL https://openvapt.com/llms.txt
curl -fsSL https://openvapt.com/checks/catalogue.json | jq '.checks[] | select(.severity=="critical") | .id'
curl -fsSL https://openvapt.com/checks/HOST-SSH-001.md
curl -fsSL https://openvapt.com/feed.xml
Every file is covered by the OpenVAPT Source-Available Licence 1.3: read, study and use for your own use; no selling and no services. Quoting with credit is welcome; see Citing OpenVAPT.