django-DefectDojo - Open-Source Unified Vulnerability Management, DevS

项目说明

DefectDojo

<table>
<tr styl="margin: 0; position: absolute; top: 50%; -ms-transform: translateY(-50%); transform: translateY(-50%);">
<th>
<a href=" target="_blank" rel="noopener">
<img style="width: 282px; height: 56px" src="
alt="Open Source Security Index - Fastest Growing Open Source Security Projects" width="282" height="56" />
</a>
</th>
<th>
<p>
<a href=" src=" alt="OWASP Flagship"></a>
<a href=" src=" alt="GitHub release"></a>
<a href=" src=" alt="YouTube Subscribe"></a>
<a href=" src=" alt="Twitter Follow"></a>
</p>
<p>
<a href=" src=" alt="Unit Tests"></a>
<a href=" src=" alt="Integration Tests"></a>
<a href=" src=" alt="CII Best Practices"></a>
</p>
</th>
</tr>
</table>

DefectDojo is a De, ASPM (application security posture management), and
management tool. DefectDojo orchestrates end-to-end security testing, tracking,
deduplication, remediation, and reporting.

Demo

Pro Edition: pro.demo.defectdojo.com

OWASP Community Edition: demo.defectdojo.org

Either demo en can be logged into with username admin and password 1Defectdojo#appsec. Please note that the demos are publicly accessible
and reset every day. Do not put sensitive data in the demo. An easy way to test DefectDojo is to upload some sample scan reports.

Quick Start for Docker Compose

This quick start guide will do the following

Clone the repository and change directories

Start the application

Obtain admin credentials in the initializer logs. The first initialization can take up to 3 minutes to run.

if running DefectDojo in detached mode via docker compose up -d, obtain admin credentials from the initializer logs with the command below. Please note, the initializer can take up to 3 minutes to run.

docker compose logs initializer | grep "Admin password:"

Documentation

* Official Docs
* REST APIs
* Client APIs and Wrappers
* Authentication options:
* OAuth2/SAML2
* LDAP
* Supported tools
* How to Write Documentation Locally
* De

Supported Installation Options

* Pro - SaaS or self-hosted (via K8s or docker compose). Speak to our team or get Pro from $100/mo
* OS - docker compose

Community, Getting In, and Updates

<img src=" alt="DefectDojo" height="50"/>
<img src=" alt="Slack" height="50"/>
<img src=" alt="LinkedIn" height="50"/>
<img src=" alt="Twitter" height="50"/>
<img src=" alt="Youtube" height="50"/>

Checkout our new Community Portal and join the DefectDojo community on Slack!

Follow DefectDojo on LinkedIn, YouTube, and X for platform updates!

Contributing

Please see our contributing guidelines for details and standards on contributing __before__ considering or submitting a pull request.

Pro Edition

Upgrade to DefectDojo Pro! Pro transcends the do-it-yourself approach of open-source: A new UI, risk-based management, incredibile scalability, API connectors, Ser, GitHub, GitLab, Azure DevOps, automatic data enrichment, prioritization, and more! See all the differentiators at the bottom of our pricing page: defectdojo.com/pricing.

Alternatively, for information please email

About Us

DefectDojo is maintained by:
* Greg Anderson (@de | LinkedIn)
* Matt Tesauro ( | LinkedIn |
)

Core Moderators can help you with pull requests or feedback on de:
* Cody Maffucci ( | LinkedIn)

Moderators can help you with pull requests or feedback on de:
* Blake Owens ()

Hall of Fame

* Jannik Jürgens (-klar) - Jannik was a long time contributor and moderator for
DefectDojo and made significant contributions to many areas of the platform. Jannik was instrumental in pioneering
and optimizing deployment methods.
* Scholten (@ |
Sponsor |
LinkedIn) - served as a core moderator for 3 years.
's contributions were numerous and extensive. He o, improved, and optimized many parts of the
codebase. He consistently fielded questions, provided feedback on pull requests, and provided a helping hand wherever
it was needed.
* Fred Blaise ( | LinkedIn) - Fred
served as a core moderator during a critical time for DefectDojo. He contributed code, helped the team stay organized,
and architected important policies and procedures.
* Aaron Weaver ( | LinkedIn) -
Aaron has been a long time contributor and user of DefectDojo. He did the second major UI o and his
contributions include automation enhancements, CI/CD engagements, increased metadata at the product level, and many
more.
* Jay Paz () – Jay was a DefectDojo
maintainer for years. He performed Dojo's first UI o, optomized code structure/features, and added numerous enhancements.
* Charles Neill () – Charles served as a
maintainer of DefectDojo for years and wrote some of Dojo's core functionality.

Security

Please report Security issues via our disclosure policy.

License

DefectDojo is licensed under the BSD 3-Clause License

项目信息

开发语言：Python

Star 数：4983

技术要点

该项目属于漏洞知识库方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Open-Source Unified Vulnerability Management, DevSecOps & ASPM展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。