Skip to content


Folders and files

Last commit message
Last commit date

Latest commit


Repository files navigation


Open Source Security Index - Fastest Growing Open Source Security Projects

OWASP Flagship GitHub release YouTube Subscribe Twitter Follow

Unit Tests Integration Tests CII Best Practices

Screenshot of DefectDojo

DefectDojo is a DevSecOps, ASPM (application security posture management), and vulnerability management tool. DefectDojo orchestrates end-to-end security testing, vulnerability tracking, deduplication, remediation, and reporting.


Try out DefectDojo on our demo server at

Log in with username admin and password 1Defectdojo@demo#appsec. Please note that the demo is publicly accessible and regularly reset. Do not put sensitive data in the demo.

Quick Start for Compose V2

From July 2023 Compose V1 stopped receiving updates.

Compose V2 integrates compose functions into the Docker platform, continuing to support most of the previous docker-compose features and flags. You can run Compose V2 by replacing the hyphen (-) with a space, using docker compose instead of docker-compose.

# Clone the project
git clone
cd django-DefectDojo

# Building Docker images

# Run the application (for other profiles besides postgres-redis see  
./ postgres-redis

# Obtain admin credentials. The initializer can take up to 3 minutes to run.
# Use docker compose logs -f initializer to track its progress.
docker compose logs initializer | grep "Admin password:"

For Docker Compose V1

You can run Compose V1 by editing the files below to add the hyphen (-) between docker compose.

Navigate to http://localhost:8080 to see your new instance!


Supported Installation Options

Community, Getting Involved, and Updates

Slack LinkedIn Twitter Youtube

Join the OWASP Slack community and participate in the discussion! You can find us in our channel there, #defectdojo. Follow DefectDojo on Twitter, LinkedIn, and YouTube for project updates!


⚠️ We have instituted a feature freeze on v2 of DefectDojo as we begin work on v3. Please see our contributing guidelines for more information. Check out our latest update on v3 here.

Pro Edition

Upgrade to DefectDojo Pro today to take your DevSecOps to 11. DefectDojo Pro is designed to meet you wherever you are on your security journey and help you scale, with enhanced dashboards, additional smart features, tunable deduplication, and support from DevSecOps experts.

Alternatively, for information please email

About Us

DefectDojo is maintained by:

Core Moderators can help you with pull requests or feedback on dev ideas:

Moderators can help you with pull requests or feedback on dev ideas:

Hall of Fame

  • Valentijn Scholten (@valentijnscholten | Sponsor | LinkedIn) - Valentijn served as a core moderator for 3 years. Valentijn’s contributions were numerous and extensive. He overhauled, improved, and optimized many parts of the codebase. He consistently fielded questions, provided feedback on pull requests, and provided a helping hand wherever it was needed.
  • Fred Blaise (@madchap | LinkedIn) - Fred served as a core moderator during a critical time for DefectDojo. He contributed code, helped the team stay organized, and architected important policies and procedures.
  • Aaron Weaver (@aaronweaver | LinkedIn) - Aaron has been a long time contributor and user of DefectDojo. He did the second major UI overhaul and his contributions include automation enhancements, CI/CD engagements, increased metadata at the product level, and many more.


Please report Security issues via our disclosure policy.


DefectDojo is licensed under the BSD 3-Clause License