Skip to content

Releases: SentinelSAST/pentestplate

Release list

v0.1.0 — first release

v0.1.0 — first release Latest
Latest

Choose a tag to compare

View all tags
@SentinelSAST SentinelSAST released this 26 Sep 22:01
v0.1.0
cc255f8

First release. Everything below is in this build — there is no earlier version
to upgrade from.

pentestplate runs a penetration testing engagement. It does not scan
anything.

What it does

  • Scope — in-scope and out-of-scope targets, test window, methodology, tester assignment and a plain-language executive summary, with a readiness checklist of what is still missing before you report.
  • Findings — severity, CVSS vector and score, CWE/CVE references, confidence, evidence files, and the PTES/NIST fields clients ask for (steps to reproduce, proof of concept, impact, likelihood, inherent and residual risk).
  • QA gate — findings move draft → pending review → approved | rejected. A generated report includes only approved findings by default and records how many QA is still holding back, so the totals are never silently short. The Pentester role deliberately holds no finding:approve.
  • Remediation — open → mitigating → resolved → verified, validated against an explicit transition table, so nothing jumps from open straight to verified.
  • Reports — PDF, HTML, Excel and JSON; executive, technical, detailed, compliance, PCI-DSS, HIPAA, SOC 2 and ISO 27001. Cover page, severity breakdown, CVSS matrix, OWASP mapping, methodology and remediation tracker.
    Reports move draft → in review → approved → delivered, and regenerating supersedes rather than overwrites what the client already has.
  • Evidence — stored on disk with a SHA-256 checksum, in sharded directories.
  • Assets — hosts, URLs and APIs recorded per engagement; findings link back to what they are on.
  • Audit trail — every state change, review and sign-off, with the actor and the before/after values.
  • Multi-tenant RBAC — wildcard-capable permissions scoped by tenant and enforced in the API; the web client holds no authorisation logic of its own.

Security fixes in this build

The v0.1.0 tag was moved onto these commits, so this release contains them.
Dependabot raised 52 advisories against the first build of it; the dependency
set was updated to clear them all.

Package From To Why
next 16.2.9 16.3.3 critical — two unauthenticated RCEs (Image Optimization API via AVIF; Windows-hosted servers)
github.com/jackc/pgx/v5 5.6.0 5.9.2 critical
undici 7.28.0 7.30.0 high
@tiptap/* 3.27.4 3.31.3 high — ReDoS in attribute parsing, prototype pollution
js-yaml 4.3.0 4.3.2 high
browserslist 4.28.6 4.29.1 high — unbounded memory growth
nanoid 3.3.16 3.3.19 high
postcss 8.5.19 8.5.23 medium
vitest / @vitest/mocker 4.1.10 4.1.11 medium — path traversal
baseline-browser-mapping 2.10.43 2.11.26 medium
github.com/quic-go/quic-go 0.59.0 0.59.1 medium
filippo.io/edwards25519 1.1.0 1.1.1 low

Both published images were rebuilt from this commit. If you pulled 0.1.0 or latest before the tag moved, pull again.

Install

git clone https://github.com/SentinelSAST/pentestplate.git
cd pentestplate
cp .env.example .env
docker compose up --build

Then open http://localhost:3000 and sign in as admin@example.com /
admin123.

Warning

Those defaults are published in this repository. Change the admin password,
and set POSTGRES_PASSWORD and a random JWT_SECRET, before the stack is
reachable by anyone else. See SECURITY.md
for the rest of the hardening checklist.

Images

docker-compose.yml builds from source. Prebuilt images are also published to Docker Hub (linux/amd64), tagged 0.1.0 / v0.1.0 to match this release, plus a moving latest:
API rush167/pentestplate-api:0.1.0
Web rush167/pentestplate-web:0.1.0

Set API_IMAGE and WEB_IMAGE to those and run docker compose up to skip the build. Pin 0.1.0 rather than latest for a reproducible deployment. Each image has its own overview on Docker Hub; the web one documents the build-time
NEXT_PUBLIC_API_URL caveat below.

Stack

Go 1.25 · Gin · GORM · PostgreSQL 16 · Next.js 16 · React 19 · TanStack Query ·
Docker Compose.

Known limitations

  • Pre-1.0. Expect occasional breaking changes, and there is no automatic migration path between releases yet.
  • Not a scanner. No discovery, no fuzzing, no nmap/Burp/Nuclei wrapper. Scanner output is an input to this, not a competitor to it.
  • The demo seeder creates accounts with passwords published in this repository (go run ./cmd/seed-data). Run it on a throwaway database only.
  • The web image bakes NEXT_PUBLIC_API_URL at build time. The published image points at http://localhost:8080/api/v1, so deploying it anywhere else means rebuilding with your own URL.
  • linux/amd64 only.

MIT licensed.

Assets 2
Loading