Dradis Framework Community Edition is a free, GPL-2.0-licensed collaboration framework and penetration testing report generator written in Ruby, built for IT security teams that need to consolidate findings from many security tools into consistent, professional reports.

What it is

Dradis Framework is an open-source collaboration platform for penetration testing and security auditing, published under the GPL-2.0 licence and hosted on GitHub as dradis/dradis-ce. It has existed since 2007 and sits in the InfoSec tooling ecosystem alongside the scanners and proxies it collects results from. The project ships in two editions: the Community Edition covered here, which is free and open source, and a Professional Edition offered by the same maintainers with report automation, collaboration, and client communication features. The repository carries the topics collaboration, infosec, penetration-testing, pentesting, security, and security-audit, and the homepage is https://dradis.com/ce/.

The concrete problem it solves is the manual work of assembling a penetration test report. Testers typically run many tools, then copy-paste output into a document and rewrite the same finding descriptions again and again. Dradis imports data from those tools into a shared note repository, so findings live in one place and get written up once. It replaces the ad hoc workflow of scattered scanner exports, personal notes, and hand-assembled documents.

Key capabilities

• Imports and consolidates findings from Burp Suite, Nessus, Nmap, Metasploit, Nikto, OpenVAS, Qualys, NeXpose, SAINT, Zed Attack Proxy (ZAP), Brakeman, and MediaWiki, with the full list at dradis.com/integrations/.
• Notes support markup for text styles, code blocks, images, and links, so evidence sits in the same place as the write-up.
• Publishing is driven through a flexible and simple extensions interface rather than a fixed template.
• Runs platform independent, so teams on mixed operating systems share one instance and one set of notes.
• Small and portable by design, so it works on site without outside connectivity.
• Two editions ship from the same codebase: Community Edition under GPLv2, and Professional Edition for teams needing report automation and client communication tools.
• A prebuilt container image, dradis/dradis-ce, gives a single-command deployment path.

Who uses it and how

• Penetration testing teams working on client sites, where the "small and portable" goal means the whole team can keep collaborating with no outside connectivity.
• Security auditors consolidating output from several scanners into one repository instead of reconciling separate exports by hand.
• Mixed-OS testing teams that cannot standardise on a single operating system, since Dradis is platform independent.
• InfoSec teams that want repeatable, consistent report structure across engagements rather than a fresh document per project.
• Contributors and users who need help through the Community Forums at discuss.dradis.com, the project Slack channel, or IRC channel #dradis on irc.freenode.org, and who contribute following CONTRIBUTING.md.

Getting started

Installing from Git is the recommended route, documented at dradis.com/ce/documentation/install_git.html. For containers, pull dradis/dradis-ce:latest and run docker run -it -p 3000:80 dradis/dradis-ce; developers can instead build the preconfigured Development Container with docker compose -f .devcontainer/compose.yaml up --build -d.

How it compares

The facts provided name no third-party reporting products that this project replaces, and no directly comparable open-source tool is listed either, so within this registry Dradis CE stands alone as a pentest collaboration and reporting framework. Its nearest point of contrast is the same vendor's Professional Edition, which is the commercial option adding report automation, collaboration, and client communication tools; the Community Edition remains free under GPLv2 for teams that can run it themselves.

When to use it — and when not to

Choose Dradis CE if the team is willing to run its own instance: the README notes that deploying a Dradis Community instance requires accounts with cloud providers to get started, and it points outward to dradis.com for installation documentation rather than carrying full deployment instructions in the repository. Teams that want a managed workflow with report automation and client communication built in should look at the Professional Edition instead of assembling that from CE. One honest caveat: much of the pre-2016 SVN and Git history is no longer available in the current repository after a migration, so older change context is harder to trace.

docker image pull dradis/dradis-ce:latest

docker run -it -p 3000:80 dradis/dradis-ce

docker compose -f .devcontainer/compose.yaml up --build -d