RedAmon

RedAmon is an open-source, self-hosted framework for authorized security testing that helps teams find and fix vulnerabilities in their own systems. It maps an organisation's attack surface into a knowledge graph, triages the findings with AI, confirms them by testing from an isolated sandbox behind human approval gates, and opens pull requests that fix the vulnerable code. Built-in Rules-of-Engagement checks keep testing inside the authorized scope.

Since the project started in late December 2025 it has reached about 3,200 GitHub stars, 680 forks and more than 2,000 commits, with about 20 outside contributors so far. It scored 101 of 104 on the XBOW validation benchmark, fully black-box. NVISO, a European security firm, is its founding sponsor.

RedAmon is MIT-licensed, and the complete project stays free to use and update.