Categories
Self-Hosted DevSecOps Vulnerability Management ASPM Application Security Security Reporting Finding Deduplication OWASPStars
Forks
Watchers
Developer links
DefectDojo
Security scanners each report in their own format, and DefectDojo is the self-hosted platform that imports those reports and keeps a single, triaged list of findings. Reports in mixed formats? More than 350 built-in parsers read output from Burp Suite, ZAP, Trivy, Tenable Nessus, SonarQube, Snyk, and Checkmarx, and Generic Findings Import covers tools without a parser through CSV or JSON files. The same scan every night? Reimport adds new findings, can close the ones that vanished, and reopens the ones that return, while deduplication ties repeat detections inside an asset to their original. Decisions already made? False positive, out of scope, and risk accepted statuses survive reimport, so nobody triages the same noise twice. A deadline on every fix? Severity-based SLA countdowns flag breaches and can notify the users assigned to each asset, and full risk acceptances carry notes, files, and an expiry date that returns findings to active by default. Many teams, many applications? Organizations, assets, engagements, and tests mirror how security work is organized, with permissions that cascade downward. Pipelines that should report themselves? The REST API and CI/CD engagements import results automatically, and findings push to Jira as tickets. Someone outside security wants a summary? Dashboards track metrics, and a widget-based report builder produces HTML reports that print to PDF. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. BSD-3-Clause licensed.
Benefits
- One place for every scan result
- Import and reimport reports through more than 350 built-in parsers, converting each scanner's output into uniform findings so teams triage a single consistent list instead of juggling separate tool dashboards.
- Fewer duplicates, faster triage
- Deduplication links repeat detections within an asset to one original finding, and reimport keeps false positive, out of scope, and risk accepted decisions so analysts rarely re-triage the same noise.
- Remediation deadlines you can track
- Severity-based SLA countdowns mark each finding as mitigated within deadline or in breach, breaches can notify assigned users, and expiring risk acceptances reactivate findings so postponed risks return to the queue.
- Built for CI/CD automation
- A full REST API and CI/CD engagements let pipelines import scan results automatically, while the built-in Jira integration pushes findings to the tickets developers already work from.
Features
- 350+ Scanner Parsers
- Parsers for Burp Suite, ZAP, Trivy, Tenable Nessus, SonarQube, Snyk, and Checkmarx, plus Generic Findings Import for CSV or JSON from tools without a dedicated parser.
- Asset Hierarchy
- Organizations, assets, engagements, tests, and findings structure security work, with access permissions that cascade from organizations and assets down to every finding beneath them.
- Reimport and Deduplication
- Reimport adds, mitigates, and reactivates findings by comparing each new report with the existing test, and four deduplication algorithms group repeat detections under one original.
- Triage and Risk Acceptance
- Statuses include verified, false positive, out of scope, under review, and mitigated, while full risk acceptances attach notes, files, and expiration dates to bundled findings.
- SLA Tracking and Jira
- Severity-based SLA countdowns flag breaches and can notify assigned users, and the Jira integration pushes findings to tickets so remediation happens where developers work.
- Metrics, Reports, REST API
- Dashboards track metrics, a widget-based report builder exports HTML or print-to-PDF reports, and a full REST API drives imports, reimports, and updates from CI/CD pipelines.
