AppSec Management Platform
GitHub

Open source · Self-hosted · Apache-2.0

Know every application's security risk, who is fixing it, and by when.

One place for your application inventory, open-source vulnerabilities from SBOMs, SLA tracking, risk exceptions with maker–checker approval, and the evidence your auditors ask for.

Get started View on GitHub
Overview dashboard: open, overdue and fixed-on-time figures, severity breakdown and the vulnerabilities to handle first
SBOMCycloneDX & SPDX, Dependency-Track sync
KEV · EPSSExploitation signals on every finding
L1–L3Maker–checker approval levels
TH / ENThai and English interface

What it does

Built for AppSec teams, developers, managers and auditors. Each role sees only what it needs.

SBOM inventory

Pulls projects, components and findings from OWASP Dependency-Track, enriched with CISA KEV, FIRST EPSS and OSV aliases. Vendor SBOMs can be uploaded by hand.

SLA per issue, not per build

The clock starts when a vulnerability first appears in an application and keeps running across releases, so a new build never buys extra time.

Risk exceptions, maker–checker

Risk acceptance, false positive and not-affected requests with reference numbers, approval by severity (L1–L3), residual severity backed by a control library, and expiry.

Audit-ready evidence

Which version ran where and when, the scan and SBOM hash behind it, who approved each exception, and every bypass at the upstream tool, exported in one pack.

Versioned severity & SLA policy

CVSS, EPSS and KEV rules decide the tier. Policy versions are effective-dated and never edited, so every past decision can be reproduced.

Executive monthly report

Open, found, fixed, on-time rate, top risks and exceptions for any month, per organisation or team. Print or save as PDF.

Microsoft Entra ID

Sign in with Microsoft (OIDC + PKCE), SCIM provisioning, and roles from Entra groups or app roles. A local break-glass admin stays available.

Pentest, ITSM and more

Pentest projects and cost reporting, Jira ticket routing by severity, a go-live checklist, an append-only audit trail, light and dark themes.

A look inside

Real screens from the demo data. Switch the page language to see the Thai interface.

How it fits your pipeline

  1. 1CI builds and scans

    Your pipeline sends the SBOM to Dependency-Track and records the deployment.

  2. 2The platform syncs

    Findings are tiered by policy, grouped per issue and given an SLA.

  3. 3Teams act

    Developers plan the fix or request an exception; AppSec and management approve.

  4. 4Everyone can prove it

    Reports for leadership, evidence packs for auditors, all from the same data.

Quick start

Needs Docker. The dev stack includes Dependency-Track and demo data.

  • Open http://localhost:5173 and sign in as appsec.lead / ChangeMe123!
  • Production: one script installs the platform and Dependency-Track, generating every secret.
  • Air-gapped servers: build an offline bundle with all images.
Deployment guide (Thai)
Local development
git clone https://github.com/nongkon09/AppSec_Management.git
cd AppSec_Management
docker compose -f docker-compose.dev.yml up -d
docker compose -f docker-compose.dev.yml exec backend \
  python -m app.seed --demo
Production (one host)
cd deploy/production
./scripts/install.sh --host appsec.example.org

Built with

Free to use, change and self-host

Licensed under Apache-2.0. Issues and pull requests are welcome.

Star on GitHub Report an issue