rush167/pentestplate-api repository overview

⁠pentestplate API

The Go API behind pentestplate — an open-source platform for running penetration testing engagements: scope, findings, a QA review gate, remediation tracking, client reports and an audit trail.

It is not a scanner. Nothing here finds vulnerabilities; it is where you write down and manage what you found.

• Source, docs and issues: https://github.com/SentinelSAST/pentestplate⁠
• Licence: MIT · Support: [email protected]⁠

⁠This image is one third of the stack

The API needs PostgreSQL and, for a usable UI, the companion web image rush167/pentestplate-web⁠.

The easy path is the Compose file in the repository, which wires all three together:

git clone https://github.com/SentinelSAST/pentestplate.git
cd pentestplate
cp .env.example .env
docker compose up

To run the API on its own:

docker run -d --name pentestplate-api \
  -p 8080:8080 \
  -e DB_URL='postgresql://postgres:CHANGE_ME@your-postgres:5432/ptplatform?sslmode=disable' \
  -e JWT_SECRET="$(openssl rand -hex 32)" \
  -e ALLOW_REGISTRATION=false \
  -v ptplatform-data:/app/uploads \
  rush167/pentestplate-api:0.1.0

On boot it creates its own schema, then seeds the default tenant, the roles, the permission matrix and an [email protected] / admin123 account. Change that password before anyone else can reach it.

⁠Configuration

REDIS_URL, MINIO_* and NATS_ENDPOINT are read at start-up but not yet consumed by any feature.

⁠Health

curl http://localhost:8080/api/health
# {"status":"healthy","timestamp":"...","version":"0.1.0"}

Also available at /api/v1/health. Returns 503 when the database is unreachable.

⁠Hardening

This holds everything that goes into a client report, so treat it as sensitive:

• Set JWT_SECRET and a real POSTGRES_PASSWORD; the defaults are published.
• Put it behind TLS and a reverse proxy or VPN — do not expose the API directly.
• Keep UPLOAD_PATH on storage you back up, and restrict who can reach it.
• The demo seeder (go run ./cmd/seed-data) creates accounts whose passwords are published in the repository. Run it on a throwaway database only.

Full checklist: https://github.com/SentinelSAST/pentestplate/blob/main/SECURITY.md⁠

⁠Tags

linux/amd64. Report a vulnerability via https://github.com/SentinelSAST/pentestplate/blob/main/SECURITY.md⁠ rather than a public issue.