[opensourcedex]

vulnrepo is a free, open source business intelligence & reporting project written in TypeScript and released under Apache-2.0. It has 583 GitHub stars, 118 forks and 2 open issues, and was last pushed 7 days ago. On this registry it ranks #78 of 79 tracked projects in Business Intelligence & Reporting, with 5 head-to-head comparisons available.

What is vulnrepo?

VULNRΞPO is a free, end-to-end encrypted vulnerability report generator and repository for penetration testers, bug bounty hunters, and security consultants who need to turn scanner output into client-ready reports without sending engagement data to someone else's server.

What it is

VULNRΞPO is a client-side, privacy-first vulnerability report manager built as an Angular 22 application in TypeScript and released under the Apache-2.0 licence. It lives in the security tooling ecosystem — the same world as the scanners it consumes — and its registry category is Data & Analytics / Business Intelligence & Reporting. Rather than acting as a web service that holds your findings, it runs entirely in the browser: reports are encrypted locally and stored in browser IndexedDB, and no data leaves the machine unless an optional REST API backend is configured deliberately.

The concrete problem it solves is report assembly. A tester finishes an engagement holding raw output from Nmap, Nessus, Burp, OpenVAS, Bugcrowd, or Trivy, plus screenshots and manual notes, and then has to produce a document a client will accept. VULNRΞPO replaces that manual compile-and-paste process, and it also replaces hosted reporting repositories, because the report, its attachments, its changelog, and its templates stay under the tester's own control instead of a vendor's.

Key capabilities

  • Browser-native cryptography throughout: PBKDF2-SHA-256 key derivation at 600,000 iterations, AES-256-GCM authenticated encryption, a random 16-byte salt and 12-byte IV per encryption, with ciphertext held in IndexedDB.
  • Decryption passwords live only in an in-memory vault (KeyVaultService) and are cleared automatically when the browser tab is hidden — they are never written to sessionStorage or localStorage.
  • Findings import directly from Nmap, Nessus, Burp, OpenVAS, Bugcrowd, and Trivy, and issue templates can be pulled from CVE, CWE, MITRE ATT&CK, and PCI DSS sources, with CVE details queried from the NIST NVD database.
  • Report export to TXT, HTML, and DOCX, plus PDF through browser print, and a self-contained AES-encrypted HTML report for secure sharing; individual issues export to SARIF 2.1.0, Atlassian Jira, or a portable encrypted file.
  • File attachments with an automatically computed SHA-256 checksum, an automatic changelog for every significant report change, and versioned report history snapshots on each save.
  • Built-in methodology checklists for OWASP ASVS 4, PCI DSS 4, and The Bug Hunter's Methodology (TBHM), alongside issue merge, advanced filtering by severity, status, tags, CVE, and CVSS, and reusable report profiles carrying logo, researcher details, theme, and CSS.
  • Optional AI assistance through a locally connected Ollama model for report writing.

Who uses it and how

  • Individual penetration testers and bug bounty hunters who run single-engagement workflows and want the report to exist only on their own machine.
  • Consultancies handling client material under confidentiality constraints, where browser-local encryption satisfies the requirement that findings not sit on a third-party platform.
  • Air-gapped or restricted environments, where the Docker image or a locally built production bundle is deployed instead of the hosted application.
  • Teams that want shared report storage, which is the scenario the optional backend REST API exists to serve — encrypted reports are stored on the operator's own server rather than a vendor's.

Getting started

Use the hosted application at vulnrepo.com, or self-host by running the published Docker image kac89/vulnrepo. Building from source is also supported through the standard Angular development server and production build steps.

How it compares

No list of paid products replaced by this project is provided in the available facts, and no directly comparable competitor is named, so VULNRΞPO stands alone in this registry. The tools it does name — Nmap, Nessus, Burp, OpenVAS, Bugcrowd, Trivy, and Jira — are import and export endpoints it feeds from and into, not alternatives to it.

When to use it — and when not to

A self-hoster who wants central storage must operate the optional REST API backend themselves, and the default deployment keeps each report bound to one browser profile, so anyone without that backend needs to rely on exported encrypted files to move work between machines. Because the decryption key is held in memory only and never written to any persistent medium, a forgotten password cannot be recovered from the local store, which makes password handling a real operational responsibility rather than a convenience. Teams expecting built-in multi-user accounts, server-side access control, or managed hosting out of the box should look elsewhere; VULNRΞPO is strongest for individuals and small groups who value local data ownership over turnkey collaboration.

project readme (upstream, from github) — read inline

VULNRΞPO - Vulnerability Report Generator & Repository

License Angular Live App Docker

A client-side, privacy-first vulnerability report manager for security professionals. All data is encrypted and stored locally in your browser — nothing is sent to any server by default.

Live app: https://vulnrepo.com/ | Dev branch: https://dev.vulnrepo.com/

Video walkthrough / Tutorial:

Guide

Table of Contents

Features

  • Client-side encryption — reports are encrypted in the browser before storage; no backend required
  • Issue templates — create and reuse custom vulnerability templates; import from CVE, CWE, MITRE ATT&CK, and PCI DSS
  • Scanner imports — import findings directly from popular security tools (see Supported Import Sources)
  • Multiple export formats — TXT, HTML, DOCX; generate PDF via browser print
  • Encrypted HTML export — share an AES-encrypted, self-contained HTML report
  • File attachments — attach screenshots, tool output, or any file; SHA-256 checksum is computed automatically
  • Changelog — all significant report changes are versioned and logged automatically
  • Issue export — export issues to SARIF 2.1.0, Atlassian Jira, or as a portable encrypted file
  • Report sharing — share a full encrypted report with collaborators
  • Report profiles — save reusable report configurations (logo, researcher info, theme, CSS)
  • Template customization — edit the HTML report template and CSS directly in the app
  • Methodology tools — built-in checklists for OWASP ASVS 4, PCI DSS 4, and The Bug Hunter's Methodology (TBHM)
  • CVE search — query the NIST NVD database and pull CVE details into your report
  • Report history — automatic versioned snapshots of every save
  • Issue merge — merge duplicate or related issues
  • Advanced filter — filter and search issues by severity, status, tags, CVE, CVSS, and more
  • Bug bounty list — reference list of bug bounty programs
  • AI / LLM integration — connect a local Ollama model for AI-assisted report writing (see AI / LLM Integration)
  • Optional backend — store encrypted reports on your own server via the REST API (see API Integration)

Security Model

VULNRΞPO uses browser-native cryptography exclusively:

Property Value
Key derivation PBKDF2-SHA-256, 600,000 iterations
Encryption AES-256-GCM (authenticated encryption)
Salt 16 bytes, random per encryption
IV 12 bytes, random per encryption
Encrypted data storage Browser IndexedDB (local machine only by default)
Decryption key storage In-memory only — never written to sessionStorage, localStorage, or any persistent medium
Network No data leaves the browser unless you configure the optional API backend

Key lifetime and auto-lock

Decryption passwords are held in a short-lived in-memory vault (KeyVaultService) that is cleared automatically when any of the following occur:

  • Tab hidden — the browser tab loses focus or is switched away from (visibilitychange event)
  • Tab closed / page reload — pagehide and beforeunload events
  • Inactivity — 15 minutes of no keyboard, mouse, or touch input

After the vault is cleared, re-opening a report prompts for the password again. No key material is ever written to sessionStorage, localStorage, cookies, or any other persistent browser storage.

Reports encrypted with older versions of the app (legacy CryptoJS AES format) are automatically detected and decrypted for backward compatibility.

Important: There is no server-side key recovery. If you lose your security key, the report data cannot be recovered.

Supported Import Sources

Tool Format
VULNRΞPO Encrypted .VULNR
VULNRΞPO Decrypted Issues .JSON
Burp Suite .XML
Bugcrowd .CSV
Nmap .XML
OpenVAS 9 .XML
Tenable Nessus .NESSUS, .CSV
Trivy .JSON
Atlassian Jira .XML
NPM Audit .JSON
Semgrep .JSON
PHP Composer Audit .JSON
WIZ Issues .CSV
OWASP ZAP .JSON
BlackDuck Code Sight .JSON
SARIF 2.1.0 (CodeQL, Semgrep, Trivy, ESLint, Bandit, Checkov, …) .SARIF, .JSON

Report Export Formats

Format Notes
HTML Fully self-contained; customizable template and CSS
Encrypted HTML AES-encrypted, self-contained HTML; share safely via email or file transfer
DOCX Microsoft Word compatible
TXT Plain text
PDF Use browser Print to PDF (Ctrl+P) on the HTML export; or use the LaTeX generator for full customization

Methodology Tools

The following interactive checklists are available from the sidebar:

  • OWASP ASVS 4 — Application Security Verification Standard
  • PCI DSS 4 — Payment Card Industry Data Security Standard
  • TBHM — The Bug Hunter's Methodology

Use them during an assessment to ensure nothing is missed before finalizing the report.

AI / LLM Integration

VULNRΞPO integrates with Ollama to provide AI-assisted report writing using a locally hosted model. No data is sent to any cloud service.

Setup:

  1. Install Ollama from ollama.com.
  2. Pull and run a model:
    ollama run llama3.2:latest
  3. Allow the VULNRΞPO origin to access Ollama. If using the hosted app, set the environment variable before starting Ollama:
    OLLAMA_ORIGINS=https://vulnrepo.com ollama serve
  4. In VULNRΞPO, open AI Settings (robot icon in the report toolbar), enter your Ollama URL (http://localhost:11434 by default), select a model, and save.

Getting Started

Prerequisites

Development Server

# Install dependencies
npm install

# Start the dev server
npm start
# or
ng serve

Navigate to http://localhost:4200/. The application reloads automatically when source files change.

Production Build

ng build -c production

Build artifacts are written to dist/vulnrepo-app/. Deploy the contents of that directory to any static web host or CDN.

Docker

The official Docker image is available on Docker Hub:

docker pull kac89/vulnrepo
docker run -p 8080:80 kac89/vulnrepo

See the image page for full documentation: https://hub.docker.com/r/kac89/vulnrepo

Project Structure

vulnrepo-master/
├── src/
│   ├── app/
│   │   ├── report/                   # Core report editor component
│   │   ├── myreports/                # Report list / dashboard
│   │   ├── newreport/                # Create report wizard
│   │   ├── import-report/            # Import encrypted report file
│   │   ├── templates-list/           # Issue template manager
│   │   ├── settings/                 # App settings (profiles, API vault)
│   │   ├── asvs/                     # OWASP ASVS 4 checklist
│   │   ├── pcidss4/                  # PCI DSS 4 checklist
│   │   ├── tbhm/                     # Bug Hunter's Methodology checklist
│   │   ├── cve-search/               # NVD CVE lookup
│   │   ├── bb-list/                  # Bug bounty program list
│   │   ├── faq/                      # In-app FAQ page
│   │   ├── crypto-utils.service.ts   # PBKDF2 + AES-GCM encryption service
│   │   ├── indexeddb.service.ts      # Local storage (IndexedDB) service
│   │   ├── api.service.ts            # Optional backend API service
│   │   ├── ollama-service.service.ts # Ollama LLM integration service
│   │   └── dialog-*/                 # Modal dialogs (add issue, import, export, …)
│   ├── assets/                       # Static assets, vendor logos
│   └── environments/                 # Environment configurations
├── dist/                             # Production build output
├── API-INTEGRATION.md                # Backend API reference
├── SECURITY.md                       # Vulnerability reporting policy
├── angular.json
└── package.json

API Integration

VULNRΞPO can optionally store encrypted reports on your own backend server. The API is a simple HTTP interface with a custom header-based authentication scheme.

See API-INTEGRATION.md for the full API reference.

An example server implementation is available at: https://github.com/kac89/vulnrepo-server

Browser Support

VULNRΞPO requires a modern browser with IndexedDB and Web Crypto API support. It does not work in private/incognito browsing mode (IndexedDB is blocked by most browsers in that mode).

Tested and supported:

  • Google Chrome (latest)
  • Mozilla Firefox (latest)
  • Microsoft Edge (Chromium, latest)
  • Safari on iOS (latest)
  • Chrome on Android (latest)

Contributing

  1. Fork the repository and create a feature branch from dev.
  2. Make your changes and ensure the app builds without errors (ng build).
  3. Submit a pull request against the dev branch.

To report a security vulnerability, see SECURITY.md.

License

VULNRΞPO is released under the Apache 2.0 License.

Frequently asked questions

Is vulnrepo free to use?

vulnrepo is open source under the Apache-2.0 licence. There is no licence fee and no seat count — you can self-host it or, where the project offers one, pay a vendor for a managed version instead.

What does vulnrepo do?

VULNRΞPO - Free vulnerability report generator and repository, end-to-end encrypted! Templates of issues, CWE,CVE,MITRE ATT&CK,PCI DSS, import Nmap/Nessus/Burp/

What is vulnrepo written in?

vulnrepo is primarily written in TypeScript. Its source is publicly available at https://github.com/kac89/vulnrepo, and it has 583 GitHub stars.