OpenVAPT v0.1.0-alpha.6

Pre-release: may be incomplete or wrong, for test machines only, 100% at your own risk.

Promoted through the OpenVAPT release channels after every gate passed on commit e8fbd03; evidence: release/channels.json.
The binaries are that commit plus the vulnerability snapshot built at release time from public OSV and CISA KEV data (sha256 addb5a9f61f360b609c3f416ef37ef40414731c439312049d941cc7a895659a5); the full tests and the installer test ran again on exactly these binaries, and two separate builds of the same source produced identical bytes.

Verify before use: gh attestation verify openvapt_linux_amd64 --repo OpenVAPT/openvapt (or arm64), cosign verify-blob --bundle SHA256SUMS.sigstore.json --certificate-identity-regexp '^https://github.com/OpenVAPT/openvapt/.github/workflows/release.yml@refs/heads/main$' --certificate-oidc-issuer https://token.actions.githubusercontent.com SHA256SUMS, then sha256sum -c SHA256SUMS. Sigstore bundles cover both binaries, SHA256SUMS, the SBOM and the vulnerability snapshot.

Changes in v0.1.0-alpha.6

No changelog entries for this build.

OpenVAPT v0.1.0-alpha.5

Pre-release: may be incomplete or wrong, for test machines only, 100% at your own risk.

Promoted through the OpenVAPT release channels after every gate passed on commit a2e2d70; evidence: release/channels.json.
The binaries are that commit plus the vulnerability snapshot built at release time from public OSV and CISA KEV data (sha256 a54686523648143de5d5985be2f1cf862e2eff73e149f42ed4731720b0b5cd59); the full tests and the installer test ran again on exactly these binaries, and two separate builds of the same source produced identical bytes.

Verify before use: gh attestation verify openvapt_linux_amd64 --repo OpenVAPT/openvapt (or arm64), cosign verify-blob --bundle SHA256SUMS.sigstore.json --certificate-identity-regexp '^https://github.com/OpenVAPT/openvapt/.github/workflows/release.yml@refs/heads/main$' --certificate-oidc-issuer https://token.actions.githubusercontent.com SHA256SUMS, then sha256sum -c SHA256SUMS. Sigstore bundles cover both binaries, SHA256SUMS, the SBOM and the vulnerability snapshot.

Changes in v0.1.0-alpha.5

Stream: discovery (SEO, GEO, AEO, LLM parsing)

• Website: an Atom feed of every release at /feed.xml (linked from every page and the footer), a web app manifest, PNG icons (favicon.ico, 192, 512, Apple touch) beside the SVG mark, codemeta.json for research-software catalogues, and an IndexNow key file with scripts/indexnow.sh to notify Bing, Yandex and other IndexNow engines after a deploy.
• Website: a Markdown twin of every check page, every Academy module, the FAQ and the glossary (same address with .md), each with front matter naming the canonical page, licence and last change date; pages link them with rel="alternate" type="text/markdown" and a visible "Also available as plain Markdown" note; llms.txt explains the convention. The root .htaccess marks .md files noindex so the HTML stays the one indexed address.
• Website: new page For Machines and AI (/machine-readable.html) listing every data file for search engines, AI answer engines, researchers and tools.
• Website: structured data enriched. Organization logo as a 512 px PNG ImageObject; SoftwareApplication gains author, image, releaseNotes, softwareHelp, installUrl and softwareRequirements; TechArticle (checks) and LearningResource (modules) gain author, image, datePublished (first git commit), mainEntityOfPage, licence, keywords, section, level, time required and the Markdown encoding; FAQ and home gain SpeakableSpecification; every page carries hreflang en and x-default, a robots directive allowing full snippets and large image previews, and og:type article with published and modified times on check and module pages.
• Repository: README badges and quick links, SUPPORT.md, extra GitHub topics.

OpenVAPT v0.1.0-alpha.4

Pre-release: may be incomplete or wrong, for test machines only, 100% at your own risk.

Promoted through the OpenVAPT release channels after every gate passed on commit 12bdadd; evidence: release/channels.json.
The binaries are that commit plus the vulnerability snapshot built at release time from public OSV and CISA KEV data (sha256 a54686523648143de5d5985be2f1cf862e2eff73e149f42ed4731720b0b5cd59); the full tests and the installer test ran again on exactly these binaries, and two separate builds of the same source produced identical bytes.

Verify before use: gh attestation verify openvapt_linux_amd64 --repo OpenVAPT/openvapt (or arm64), cosign verify-blob --bundle SHA256SUMS.sigstore.json --certificate-identity-regexp '^https://github.com/OpenVAPT/openvapt/.github/workflows/release.yml@refs/heads/main$' --certificate-oidc-issuer https://token.actions.githubusercontent.com SHA256SUMS, then sha256sum -c SHA256SUMS. Sigstore bundles cover both binaries, SHA256SUMS, the SBOM and the vulnerability snapshot.

Changes in v0.1.0-alpha.4

Stream: round3 fixes

• Website: until the default release includes them, pages that mention openvapt cite, --open or the default ~/openvapt-reports folder say they arrive in the next release and show what the current release does.
• Under sudo with HOME kept, the default reports folder and its files are given back to the sudo user (checked against the user database); the base folder is checked to be a real folder owned by the expected user, and report files refuse links.
• Installer: a non-HTTPS OPENVAPT_CHANNELS_URL or OPENVAPT_BASE_URL now stops with a clear reason; its next steps describe where reports go for the installed version.
• report.md keeps URLs in the How to Cite block literal (fenced text); builds without a version are called "unreleased build" everywhere.
• NIST SP 800-115 phases worded consistently (Planning, Discovery and Reporting; no Attack phase); walkthrough marks the trimmed pre-release warnings and names its last chapter Get Started; page citations label the access date.

OpenVAPT v0.1.0-alpha.3

Pre-release: may be incomplete or wrong, for test machines only, 100% at your own risk.

Promoted through the OpenVAPT release channels after every gate passed on commit 67259ac; evidence: release/channels.json.
The binaries are that commit plus the vulnerability snapshot built at release time from public OSV and CISA KEV data (sha256 a54686523648143de5d5985be2f1cf862e2eff73e149f42ed4731720b0b5cd59); the full tests and the installer test ran again on exactly these binaries, and two separate builds of the same source produced identical bytes.

Verify before use: gh attestation verify openvapt_linux_amd64 --repo OpenVAPT/openvapt (or arm64), cosign verify-blob --bundle SHA256SUMS.sigstore.json --certificate-identity-regexp '^https://github.com/OpenVAPT/openvapt/.github/workflows/release.yml@refs/heads/main$' --certificate-oidc-issuer https://token.actions.githubusercontent.com SHA256SUMS, then sha256sum -c SHA256SUMS. Sigstore bundles cover both binaries, SHA256SUMS, the SBOM and the vulnerability snapshot.

Changes in v0.1.0-alpha.3

Fix: vulnerability data sources (2026-10-14)

• The release snapshot no longer requests a WordPress export: OSV publishes none, and the request failed the release build. WordPress core is still inventoried and WEB-CVE-001 reports it Incomplete, never Pass; README, CREDITS, THIRD_PARTY_NOTICES and docs/VULNDB.md now say so. A test checks every configured ecosystem against OSV's published list.

Stream: r2-cvss

• CVSS v3.1 vectors of 18 host checks for detective gaps and local-only weaknesses (audit, journal, logging, time sync, SSH log level, martian logging, file integrity monitoring, rootless Docker, running kernel behind installed kernel) now use a local attack vector; severities are unchanged, and the report Methodology explains the rule (A2-09).

Stream: r2-redact-report

• Redaction now masks PGP and PuTTY private keys, Laravel APP_KEY, Redis masterauth, SSSD ldap_default_authtok, Postfix static: maps, curl -u and --user, sshpass -p values, Azure AccountKey and SAS signatures, Slack webhook URLs, Grafana, SendGrid and npm tokens, user:password@host, and AWS secret keys next to their key id (A2-01).
• --only or --skip values that match no check, or a selection of zero checks, now exit 2 with a usage error; a report with zero checks never exits 0 (A2-02).
• Markdown reports show evidence in code spans sized to the content with no HTML entities, and escape Markdown syntax and autolinks in prose (A2-10).
• The executive summary in HTML and Markdown is now built from the data: scope, counts, top 5 risks by severity then CVSS with a one-line reason, coverage gaps, suppressions, snapshot age and the main limitation (A2-11).
• Reports count Incomplete targets inside passed or failed checks (incomplete_targets, matching SARIF), give every finding a confidence level (high, medium or low) in all formats, and link each failed finding to the False Positive form and the suppression docs (A2-12).
• SARIF adds invocations (success, start and end time, a command line without paths or seeds) and partialFingerprints per result (A2-12).

Stream: standards

• NIST SP 800-53 SA-12 (withdrawn in Rev. 5) replaced by SR-3, SR-4 and SR-11 on HOST-PKG-002 and HOST-PKG-003.
• WSTG references pinned to v4.2 links and labelled "WSTG v4.2" on the site.
• 86 CWE mappings that MITRE marks Discouraged replaced with specific weaknesses (CWE v4.20); 4 checks without a CWE now carry one.
• Every check maps to a CIS Controls v8 safeguard (cis_v8) and NIST CSF 2.0 subcategories (csf_2); the coverage page and catalogue.json count per safeguard and subcategory.
• HOST-PWD-003 now requires a minimum password length of 15 (NIST SP 800-63B-4 single-factor minimum).
• New test rejects withdrawn 800-53 controls, Discouraged CWEs, empty CWE and CIS references without a safeguard id.

Stream: checks-fp

• Installed packages on Debian and Ubuntu come from /var/lib/dpkg/status entries marked "install ok installed"; a package removed but not purged no longer counts (HOST-SVC-002..012, HOST-PKG-004, HOST-PKG-005).
• Container detection (/.dockerenv, /run/.containerenv, /proc/1/cgroup, /proc/self/mountinfo, container= in /proc/1/environ): boot, Secure Boot, kernel module, non-namespaced kernel parameter, host mount, time sync, host firewall and auditd checks are Skipped with "this setting belongs to the host", and the report's Limitations say the scan ran in a container.
• NET-DB-014 and NET-DB-015 judge the default by server flavour and version: pass with a note on MySQL 8.0 and later, fail on MariaDB and MySQL before 8.0, Incomplete when unknown.
• NET-MAIL-002 and NET-MAIL-003 pass with a note when Postfix inet_interfaces is loopback only; NET-DB-023 passes with a note when Redis binds loopback only with protected-mode on.
• HOST-KRN-022 passes with a note when AppArmor restricts unprivileged user namespaces (Ubuntu 23.10 and later); HOST-KRN-025 passes with a note when the IPv6 default route was learned from a router advertisement; HOST-KRN-027 passes with a note when kdump is enabled.
• HOST-PAM-002 is Skipped when no pam_faillock exists, so HOST-PWD-004 alone reports a missing lockout (PWD-004 covers deny, PAM-002 covers unlock_time).
• HOST-AUD-002..007 need auditd active for a Pass (Incomplete otherwise) and say the loaded rules were not verified; HOST-CTR-010 reads dockerd flags from docker.service drop-ins and is Incomplete when daemon.json cannot be read.
• HOST-USR-002 rescored to a local attack vector, 7.8 High (Critical only together with HOST-SSH-003).
• Caution sentences added to Fix text that could lock users out or break services (kernel parameters, PAM, mounts, cron.allow, SUID removal, auditd, Secure Boot, module blocking, firewall, mail and database TLS, legacy service removal).

Stream: cli-suppress

• --suppress <file> for scan and demo: accepted findings need a reason and an expiry (at most 365 days); they stay visible in every report format, carry a SARIF external suppression, and do not count toward --fail-on.
• openvapt man prints a manual page generated from the command table; make man writes openvapt.1.
• openvapt completion bash|zsh|fish prints shell completion generated from the same command and flag definitions.
• Help, the man page and the README now share one exit code table, checked by a test.

Stream: academy-quizzes (2026-10-14)

• Academy: every module quiz now has at least five questions with four options, plausible distractors and an explanation; the 21 original modules (F1 to F3, P1 to P14, A1 to A4) gained new questions and the newer modules gained options.
• Academy: long sentences are split so none runs over 30 words (original modules aim for 25 or fewer); tests enforce quiz depth, distinct options, answer ranges and sentence length for every module.
• Academy fact fixes: P2 now says RFC 9142 deprecates SHA-1 key exchange (it does not cover MACs); P7 states NIST SP 800-63B-4's 15-character minimum for single-factor passwords (8 with another factor); A4 points to the lab fixtures in internal/lab instead of only lab.go.

Fix: asset cache busting (2026-10-14)

• The site's own CSS and JavaScript links carry a content hash (?v=), and the chart and catalogue loaders add a hash of the vendored libraries, so the new cache headers can never serve a stale stylesheet or script after a deploy. Found by browser-testing the live site at phone width.

Stream: worldwide audience (owner instruction 2026-10-14)

• OpenVAPT is stated to be open to anyone, in any country: EULA 2.5 (section 22, acknowledgements 1.8 statement 8 names computer misuse laws from several regions as examples, liability cap USD 1 or its equivalent instead of RM1), Disclaimer 1.8, Privacy 1.7 (section 6 written for worldwide data protection laws), Teaching 1.4, SECURITY.md accepts reports in any language, security.txt lists English only.
• Academy F2, the teaching plan, the teach and limits pages, ADR 0001 and AGENTS.md name laws from several regions instead of Malaysian law only; Malaysian law still governs the Agreement because that is where the licensor is.
• New FAQ entry "Who Can Use OpenVAPT, and in Which Countries?"; README, llms.txt and JSON-LD (audience: Worldwide) say the same.
• Two fresh-context AI legal reviews approved the revision (release/legal-review.json).
• Licence 1.3 (clarified before any release carried it) states it is offered to anyone in any country (section 14) and names fair dealing and fair use under the user's own copyright law (section 13). AGENTS.md 1.5 adds duty 6.13 (worldwide audience); CLAUDE.md, GOVERNANCE.md, CONTRIBUTING.md and GCA say the same. Dependabot schedules run on UTC. GitHub repository and organisation profiles say "anyone in any country" and "Worldwide".

Stream: website verification fixes (2026-10-14 review, 14-verify-website)

• Check catalogue: the search box and the Domain, Category and Severity selects now filter the plain table on every screen width (and before the grid loads), keep the "N of 307 checks" counter current and show a "No checks match" row; on wide screens AG Grid takes over the same controls as before.
• Academy: modules are listed in teaching order (F1 to F3, P1 to P22, A1 to A6) on the website, in openvapt learn and in the worksheets, whatever file defines them; a test enforces the order.
• Academy: P17 to P22, A5 and A6 name the modules to read first; a test requires every Practitioner and Applied module to have prerequisites.
• Phone notice: Read More becomes Read Less while open and the one-line summary is hidden so no sentence is shown twice.
• Coverage page: the chart library loads at once instead of waiting for the charts to scroll into view.
• For Teachers: the four overview cards are "Jump to" links to their sections instead of repeated headings.
• Site .htaccess: 403 responses show the 404 page; the /tools/ carve-outs are marked for removal wit...

OpenVAPT v0.1.0-alpha.2

Pre-release: may be incomplete or wrong, for test machines only, 100% at your own risk.

Promoted through the OpenVAPT release channels after every gate passed on commit 1279124; evidence: release/channels.json.
The binaries are that commit plus the vulnerability snapshot built at release time from public OSV and CISA KEV data (sha256 5f78bc5651c0634d3d47042235f3ef4715264adbba11fac63ff9bf206d1137c0); the full tests and the installer test ran again on exactly these binaries.
Verify before use: SHA256SUMS, Sigstore bundles, build provenance and SBOM are attached.

Changelog

All notable changes are documented here. This project follows Semantic Versioning and Conventional Commits.

[Unreleased]

Audit and Fixes (Claude, with three independent AI review passes)

• Severity now always matches the check's own CVSS v3.1 vector: a shared calculator (internal/check/cvss.go, tested against FIRST reference scores) is enforced at registration; 56 overstated or wrong vectors corrected and 12 severities adjusted to their honest scores.
• Release pipeline: release.yml runs only from promote.yml (no gate bypass by tag push), re-runs the tests and installer test on exactly the shipped binaries, states the embedded snapshot checksum, covers every asset in SHA256SUMS, is safe to re-run, and pins every action to a commit; the record step retries on a moving main and refuses a version that differs from the published one; channel outputs are validated; promotion requires the exact tested commit and the same release cycle.
• Installer: signature identity pinned to release.yml on main, Ctrl-C stops it, help works when piped, clear error when HOME is unset, Windows line endings tolerated.
• Check accuracy: negated iptables and nftables sources and ports, nftables comments and loopback rules, ufw rules on lo, systemd drop-ins ordered across all directories including /run, commented-out WordPress define() lines ignored, Django's last DEBUG assignment honoured, --inspect-port no longer reported as the inspector.
• Teacher toolkit: openvapt teach (course plans, worksheets and answer keys, rubric, practice-lab answer keys with --only and --skip), seeded practice labs (openvapt demo --lab practice --seed), For Teachers page, printable worksheets and keys for every module, TEACHING.md.
• Website: Title Case fixes, noindex on sample reports, clearer channel gate wording, CITATION.cff version.

Release Channels

• One codebase and one website with four channels: Alpha, Beta, Release Candidate and Stable. Promotion is decided by evidence gates in internal/channels (CI, lab proof, soak time, AI legal review of the exact build, installer test, signing, provenance and SBOM, public release sign-off), run daily by .github/workflows/promote.yml; every promotion is recorded in release/channels.json (Claude).
• openvapt version, every report and the website show the channel; pre-release builds carry a warning. The installer takes --channel (Stable by default). The website stays noindex until a signed-off Stable release exists. New Release Channels page.

Licence and Legal (2026-10-13)

• Licence version 1.1 (LicenseRef-OpenVAPT-SAL-1.1): release v0.1.0-alpha.1 was published under version 1.0, so the widened Teaching grant is a new version rather than an edit of 1.0. Version 1.1 adds the Teaching With OpenVAPT terms and their conditions and leaves every other term unchanged; licence section 15 records the history. A student's own machine is that student's Own Use, not Teaching.
• Relicensed before any release from PolyForm Noncommercial 1.0.0 with an Additional Permission to the self-contained OpenVAPT Source-Available Licence 1.0 (LicenseRef-OpenVAPT-SAL-1.0): only Own Use is licensed, and providing any service, paid or unpaid, is not licensed for anyone. ADDITIONAL-PERMISSION.md removed. Free Teaching (simulated lab or the institution's own authorised machines) is licensed and is not a service.
• Pre-release warning for alpha, beta and rc builds in the licence, EULA, Disclaimer, Acceptable Use Policy, README and website.
• TEACHING.md 1.0, Teaching With OpenVAPT terms; licence Teaching definition and grant aligned; EULA 2.1, Acceptable Use Policy 1.5, Licence summary 2.1.
• Terminology: OpenVAPT is described as researched, developed and built by AI Cybersecurity Engineers under human direction.
• EULA 2.0, Disclaimer 1.4, Acceptable Use Policy 1.3, Licence summary 2.0, acknowledgements 1.3: gift framing, no relationship or duty, release of claims, no reliance, read-down liability limit, non-affiliation notice for third-party names, installer risk notice.

Coverage Expansion: Services, Firewall Correlation, Application Stacks and CMS

• 31 new checks, 165 in total (Claude): systemd service hardening HOST-SYSD-001 to 005 (root services, sandboxing, writable unit files and programs, secrets in Environment=); firewall versus listener correlation NET-FW-003 to 006 (sensitive ports open to anywhere, stale rules, Docker bypassing the host firewall, exposure map) and NET-APP-001 (application server ports exposed directly); Apache Tomcat WEB-TOM-001 to 005 (Manager restriction, default credentials, shutdown port, AJP Ghostcat, sample apps); Node.js WEB-NODE-001 to 003 (end of life, inspector, production mode); Python WEB-PY-001 to 005 (Django DEBUG, ALLOWED_HOSTS, generated SECRET_KEY, Flask/Werkzeug debugger, development servers); CMS WEB-CMS-004 to 011 (configuration permissions, WordPress debug display, file editor and automatic updates, Joomla debug and version manifest, Drupal changelog).
• New read-only collectors for systemd units with drop-ins, ufw, nftables and iptables allow rules, Tomcat installations, Django settings and CMS configuration; node --version added to the read-only command allow-list.
• Academy modules P11 (systemd), P12 (firewall policy versus listeners), P13 (Tomcat, Node.js, Python) and P14 (CMS hardening), seven new glossary terms; vulnerable and hardened labs extended so every new check is proven both ways.

Vulnerability Management and Containers

• Offline vulnerability matching: HOST-CVE-001 to 003 and WEB-CVE-001, Debian and RPM version comparison, inventory of OS packages and web libraries, release-time snapshot from OSV and CISA KEV (OpenAI Codex, GPT-6; reviewed and corrected by Claude).
• Docker and Kubernetes host checks HOST-CTR-001 to 004 and HOST-K8S-001 to 003; Academy modules P9 and P10 (Claude).

Redesign to Professional Standards

• Control-category framework: every check belongs to one of ten categories mapped to CIS Controls v8 and NIST CSF 2.0, with a remediation effort and OWASP WSTG ids where applicable (Claude).
• 123 checks (from 58): 47 server and web checks by Claude; 18 network, data-service and TLS checks by OpenAI Codex.
• Report schema v3 with executive summary, risk heat map, framework coverage and prioritised remediation plan (OpenAI Codex).
• Coverage Dashboard, category and standard filters in the catalogue, Academy modules P7 and P8 (Claude).

Security and Fixes (contributed by OpenAI Codex, reviewed by Claude)

• Independent code review by OpenAI Codex (17 findings) and fixes for all 16 code findings: exclusive private report writing, exact command allow-list, SSH Match evaluation, Incomplete status instead of false passes, stricter firewall, HSTS, CSP and TLS checks, certificate chain verification, vhost include parsing, Debian LTS dates, Markdown escaping.
• New checks HOST-SSH-007 (forwarding and tunnels) and HOST-SSH-008 (login grace and authentication methods), documented exit codes, report schema v2, coverage-gap summaries, docs/REPORT_SIGNING.md.

Added (contributed by Claude)

• OpenVAPT Academy (15 modules, glossary, openvapt learn), FAQ and comparison pages, structured data, acknowledgement gate, AI disclosure, credits, contributors, revised legal documents.

Added

• First public build of OpenVAPT: 58 read-only checks across server, network and web apps.
• Loopback-only scope guard, read-only command allow-list, dry-run recorder.
• Reports in HTML, JSON, SARIF 2.1.0 and Markdown, with methodology and limitations; report diff; Ed25519 report signing.
• Simulated vulnerable and hardened lab servers (openvapt demo) used by the test suite.
• Website generator that cites the source of every check.

OpenVAPT v0.1.0-alpha.1

Pre-release: may be incomplete or wrong, for test machines only, 100% at your own risk.

Promoted through the OpenVAPT release channels; gate evidence: release/channels.json. Verify before use: SHA256SUMS, Sigstore bundles, provenance and SBOM are attached.

Changelog

All notable changes are documented here. This project follows Semantic Versioning and Conventional Commits.

[Unreleased]

Release Channels

• One codebase and one website with four channels: Alpha, Beta, Release Candidate and Stable. Promotion is decided by evidence gates in internal/channels (CI, lab proof, soak time, AI legal review of the exact build, installer test, signing, provenance and SBOM, public release sign-off), run daily by .github/workflows/promote.yml; every promotion is recorded in release/channels.json (Claude).
• openvapt version, every report and the website show the channel; pre-release builds carry a warning. The installer takes --channel (Stable by default). The website stays noindex until a signed-off Stable release exists. New Release Channels page.

Licence and Legal (2026-10-13)

• Relicensed before any release from PolyForm Noncommercial 1.0.0 with an Additional Permission to the self-contained OpenVAPT Source-Available Licence 1.0 (LicenseRef-OpenVAPT-SAL-1.0): only Own Use is licensed, and providing any service, paid or unpaid, is not licensed for anyone. ADDITIONAL-PERMISSION.md removed. Free Teaching (simulated lab or the institution's own authorised machines) is licensed and is not a service.
• Pre-release warning for alpha, beta and rc builds in the licence, EULA, Disclaimer, Acceptable Use Policy, README and website.
• Terminology: OpenVAPT is described as researched, developed and built by AI Cybersecurity Engineers under human direction.
• EULA 2.0, Disclaimer 1.4, Acceptable Use Policy 1.3, Licence summary 2.0, acknowledgements 1.3: gift framing, no relationship or duty, release of claims, no reliance, read-down liability limit, non-affiliation notice for third-party names, installer risk notice.

Coverage Expansion: Services, Firewall Correlation, Application Stacks and CMS

• 31 new checks, 165 in total (Claude): systemd service hardening HOST-SYSD-001 to 005 (root services, sandboxing, writable unit files and programs, secrets in Environment=); firewall versus listener correlation NET-FW-003 to 006 (sensitive ports open to anywhere, stale rules, Docker bypassing the host firewall, exposure map) and NET-APP-001 (application server ports exposed directly); Apache Tomcat WEB-TOM-001 to 005 (Manager restriction, default credentials, shutdown port, AJP Ghostcat, sample apps); Node.js WEB-NODE-001 to 003 (end of life, inspector, production mode); Python WEB-PY-001 to 005 (Django DEBUG, ALLOWED_HOSTS, generated SECRET_KEY, Flask/Werkzeug debugger, development servers); CMS WEB-CMS-004 to 011 (configuration permissions, WordPress debug display, file editor and automatic updates, Joomla debug and version manifest, Drupal changelog).
• New read-only collectors for systemd units with drop-ins, ufw, nftables and iptables allow rules, Tomcat installations, Django settings and CMS configuration; node --version added to the read-only command allow-list.
• Academy modules P11 (systemd), P12 (firewall policy versus listeners), P13 (Tomcat, Node.js, Python) and P14 (CMS hardening), seven new glossary terms; vulnerable and hardened labs extended so every new check is proven both ways.

Vulnerability Management and Containers

• Offline vulnerability matching: HOST-CVE-001 to 003 and WEB-CVE-001, Debian and RPM version comparison, inventory of OS packages and web libraries, release-time snapshot from OSV and CISA KEV (OpenAI Codex, GPT-6; reviewed and corrected by Claude).
• Docker and Kubernetes host checks HOST-CTR-001 to 004 and HOST-K8S-001 to 003; Academy modules P9 and P10 (Claude).

Redesign to Professional Standards

• Control-category framework: every check belongs to one of ten categories mapped to CIS Controls v8 and NIST CSF 2.0, with a remediation effort and OWASP WSTG ids where applicable (Claude).
• 123 checks (from 58): 47 server and web checks by Claude; 18 network, data-service and TLS checks by OpenAI Codex.
• Report schema v3 with executive summary, risk heat map, framework coverage and prioritised remediation plan (OpenAI Codex).
• Coverage Dashboard, category and standard filters in the catalogue, Academy modules P7 and P8 (Claude).

Security and Fixes (contributed by OpenAI Codex, reviewed by Claude)

• Independent code review by OpenAI Codex (17 findings) and fixes for all 16 code findings: exclusive private report writing, exact command allow-list, SSH Match evaluation, Incomplete status instead of false passes, stricter firewall, HSTS, CSP and TLS checks, certificate chain verification, vhost include parsing, Debian LTS dates, Markdown escaping.
• New checks HOST-SSH-007 (forwarding and tunnels) and HOST-SSH-008 (login grace and authentication methods), documented exit codes, report schema v2, coverage-gap summaries, docs/REPORT_SIGNING.md.

Added (contributed by Claude)

• OpenVAPT Academy (15 modules, glossary, openvapt learn), FAQ and comparison pages, structured data, acknowledgement gate, AI disclosure, credits, contributors, revised legal documents.

Added

• First public build of OpenVAPT: 58 read-only checks across server, network and web apps.
• Loopback-only scope guard, read-only command allow-list, dry-run recorder.
• Reports in HTML, JSON, SARIF 2.1.0 and Markdown, with methodology and limitations; report diff; Ed25519 report signing.
• Simulated vulnerable and hardened lab servers (openvapt demo) used by the test suite.
• Website generator that cites the source of every check.