OWASP/SecurityShepherd

Health v2 · maintenance only

Adoption not part of the score

1456 stars · 510 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

OWASP Security Shepherd is a self-hosted web and mobile application security training platform built in Java. It presents lessons and challenges covering real, hardened vulnerabilities across the OWASP Top Ten and beyond, letting users practice penetration testing skills safely.

Use cases

• train developers on web application security
• practice penetration testing on deliberately vulnerable apps
• run a security awareness course for a team
• learn mobile application security testing
• demonstrate OWASP Top Ten risks hands-on
• host a capture-the-flag style security challenge

When to choose

• you need a safe, self-hosted playground with real (not simulated) vulnerabilities
• you want structured lessons plus challenges for all skill levels
• you need configurable modules for teaching specific security topics

When to avoid

• you want a quick local vulnerable app without server setup
• you need automated vulnerability scanning rather than training
• you require a commercial LMS with user management integrations out of the box

Facets

application · maturity active

security penetration-testing security education web-development developer-tools self-hosted security-training vulnerable-app ctf owasp appsec learning-platform education docker web-server linux

Member repositories

For agents

markdown · JSON · MCP: product_card(name="OWASP/SecurityShepherd")