rush167/pentestplate-web repository overview

⁠pentestplate web

The Next.js web client for pentestplate — an open-source platform for running penetration testing engagements: scope, findings, a QA review gate, remediation tracking, client reports and an audit trail.

It is not a scanner. Nothing here finds vulnerabilities; it is where you write down and manage what you found.

• Source, docs and issues: https://github.com/SentinelSAST/pentestplate⁠
• Licence: MIT · Support: [email protected]⁠

⁠Read this before deploying

NEXT_PUBLIC_API_URL is baked into the client bundle at build time, not read at runtime. This published image was built with the default:

http://localhost:8080/api/v1

That is correct if you run it on the same host as the API and publish port 8080. If you deploy anywhere else, this image will point browsers at the wrong API and you must build your own:

git clone https://github.com/SentinelSAST/pentestplate.git
cd pentestplate/apps/web
docker build --build-arg NEXT_PUBLIC_API_URL=https://api.example.com/api/v1 -t my-registry/pentestplate-web .

Changing the value at docker run time has no effect — it is already compiled in. The Compose file in the repository passes it as a build argument for exactly this reason.

⁠Running it

Needs the API image rush167/pentestplate-api⁠ and PostgreSQL. The supported path is Compose:

git clone https://github.com/SentinelSAST/pentestplate.git
cd pentestplate
cp .env.example .env
docker compose up

Then open http://localhost:3000⁠ and sign in as [email protected] / admin123 — change that password immediately. On its own:

docker run -d --name pentestplate-web -p 3000:3000 rush167/pentestplate-web:0.1.0

⁠What is in it

• Findings with CVSS, CWE/CVE, evidence upload, and the PTES/NIST fields clients ask for
• A QA gate: findings must be approved before a report includes them
• Remediation board: open → mitigating → resolved → verified
• Report review and delivery, with regeneration creating a new version
• Asset inventory, audit trail, roles and per-tenant permissions

Runs as a non-root user, on Next.js standalone output.

⁠Tags

linux/amd64. Report a vulnerability via https://github.com/SentinelSAST/pentestplate/blob/main/SECURITY.md⁠ rather than a public issue.