OpenTest

Enterprise continuous penetration-testing platform — authorized asset discovery, AI-assisted validation, evidence-backed findings, and a remediation closed-loop.

OpenTest runs continuous, authorized security validation against your own assets. A scan-profile pipeline discovers and tests assets, an LLM-driven pentest agent performs safe-active validation under strict scope policy, every finding is backed by signed evidence, and findings flow into tickets, SLA tracking, and reports. A global kill switch, per-tool approval gates, and runtime SSRF protection keep the platform itself safe.

⚠️ OpenTest performs active security testing. Only run it against assets you own or are explicitly authorized to test. See SECURITY.md and the pentest threat model.

---

Highlights

• Continuous scan pipeline — scan profiles drive a multi-stage pipeline (discovery → baseline → web-vuln → TLS → cloud posture → SBOM correlation).
• LLM pentest agent — iterative, tool-calling agent with threat-model coverage tracking, scope enforcement, and human approval for high-risk tools.
• Evidence-first findings — every finding carries signed, redacted evidence stored in object storage; an immutable audit log uses a hash chain.
• RBAC + approvals — admin / operator / viewer roles; A3 (active) validation requires explicit approval with a rollback plan.
• Risk scoring + SLA — findings are scored and prioritized; SLA deadlines drive retest scheduling and ticketing.
• Integrations — Jira / ServiceNow ticketing, SIEM forwarding, webhooks, and a CI/CD security gate (ships as a GitHub Action — see action.yml).
• Reports — executive, engineering, and audit HTML reports plus JSON & SARIF.

Architecture

┌────────────┐     ┌──────────────────────────────────────────────┐
│  Next.js   │────▶│              Gin API server                   │
│  dashboard │ HTTP│  ┌───────────┐ ┌──────────┐ ┌─────────────┐   │
└────────────┘     │  │ handlers  │▶│ services │▶│ repositories │   │
                   │  └───────────┘ └──────────┘ └──────┬──────┘   │
                   │  middleware: auth/RBAC/CORS/metrics│          │
                   └───────────────────────────────────┼──────────┘
                                                        │
              ┌────────────────┐  ┌────────────┐  ┌─────▼─────┐
              │    Worker      │  │  Postgres  │  │  Redis    │
              │  (job runner)  │  │  + AGE     │  │ (queues)  │
              └────────────────┘  └────────────┘  └───────────┘
                                          │
                                   ┌──────┴──────┐
                                   │   MinIO     │  (evidence)
                                   └─────────────┘

Component	Tech
API server & worker	Go 1.25, Gin, sqlx
Frontend	Next.js 16 (App Router), React 19, Tailwind v4, next-intl
Database	PostgreSQL + Apache AGE (graph)
Queue / cache	Redis
Object storage	MinIO (S3-compatible)
Observability	Prometheus, Grafana, Alertmanager (optional monitoring profile)

Layering follows domain-driven design: internal/domain (pure models & repo interfaces) ← internal/service (use cases) ← internal/handler (HTTP) / internal/repository (Postgres). Plugins live in internal/plugin/builtin.

Quick start

The fastest path is Docker Compose, which brings up the full stack:

git clone https://github.com/chenchunrun/OpenTest.git
cd opentest
make dev          # builds + starts the stack, runs migrations

Then:

Service	URL	Default login
Web dashboard	http://localhost:3000	admin
API	http://localhost:8080	(seeded admin, see below)
MinIO console	http://localhost:9001	minioadmin / minioadmin

The admin user is seeded on first boot using OPENTEST_AUTH_ADMIN_SEED_PASSWORD (default Admin123!@#456 — change it in any non-dev deployment).

Configuration

All configuration is via OPENTEST_* environment variables. Required for any real deployment:

Variable	Purpose
OPENTEST_AUTH_JWT_SECRET	Required. HMAC secret for signing JWTs (validated at startup).
OPENTEST_AUTH_ADMIN_SEED_PASSWORD	Initial admin password (seeded once).
OPENTEST_DATABASE_*	Postgres host/port/user/password/db.
OPENTEST_REDIS_ADDR	Redis address.
OPENTEST_MINIO_*	Object storage for evidence.
OPENTEST_PENTEST_LLM_*	LLM provider/model/key for the pentest agent.

See docker-compose.yml for the full list with dev defaults, and configs/dev.yaml for reference. The deterministic LLM provider runs the agent without external API calls — ideal for local development and CI.

Running locally without Docker

make build              # bin/server, bin/worker, bin/migrate, bin/opentestctl
docker compose up -d db redis minio minio-init
make migrate-up
./bin/server            # API on :8080
./bin/worker &          # job runner
cd web && npm ci && npm run dev   # dashboard on :3000

Development

make verify     # the local equivalent of CI: tests + lint + build + smoke
make test       # Go tests with -race and coverage
make web-test   # frontend (vitest)
make pentest-smoke            # deterministic pentest E2E
make browser-smoke            # Playwright UI smoke

See CONTRIBUTING.md for conventions, the generated-code policy, and how to add a plugin or scan stage.

Documentation

• Architecture overview & worker network isolation
• Pentest agent operation guide & threat model
• Per-feature design docs: docs/requirements/FR-* (requirement / research / plan)

Project status

OpenTest is under active development. APIs and configuration may change before a 1.0 release. Feature design is tracked per requirement in docs/requirements/.

License

Licensed under the Apache License, Version 2.0. Contributions are welcome — see CONTRIBUTING.md. By contributing you agree that your contributions are licensed under the same terms.