OASM — Open Attack Surface Management

[l1ttps]

Hi! I came across this repository while researching open-source Attack Surface Management (ASM) solutions. Thanks to everyone who contributed to this project.

For anyone looking for an actively maintained alternative, you may want to check out OASM—a modern, open-source Attack Surface Management platform focused on continuous asset discovery, vulnerability assessment, and exposure monitoring.

Key features

• Automatic asset discovery (domains, subdomains, IPs, ports, services, and technologies)
• Vulnerability and misconfiguration detection with AI-assisted analysis and remediation guidance
• Distributed Go-based scanning engine with gRPC, designed for horizontal scaling
• AI Assistant for querying assets and security findings using natural language
• Notifications via Slack, Telegram, Webhooks, and in-app alerts
• Asset synchronization from Cloudflare, AWS, GCP, and other providers
• Simple self-hosting with Docker and Docker Compose
• Extensible architecture with support for custom scanning tools and integrations

Links

• GitHub: https://github.com/oasm-platform/open-asm
• Website: https://oasm.dev/
• Documentation: https://docs.oasm.dev/

If you're evaluating replacements for this project or starting a new ASM deployment, I hope OASM is helpful. Feedback, feature requests, and contributions are always welcome!