Self-hosted Edition

The self-hosted edition is Vulnsy packaged to run on your own server with Docker Compose. It is the same application as vulnsy.com, set up for a single organization: your team signs in at a hostname you choose, and reports, findings, evidence and user accounts are stored in a database and file store on your infrastructure.

Each release is one offline package, downloaded from the link in your license email. It contains an installer and every container image Vulnsy runs, so installing and upgrading need no container registry and no internet access on the server.

The self-hosted edition does not report back to Vulnsy. The license is checked on your server, offline, and there is no usage reporting.

What You Get

• The full application: clients, projects, findings, reports, DOCX export, and the modules your license includes (Client Portal, QA, Scoping and Disclosure).
• One organization at your own hostname, with its own users, roles and settings.
• Local accounts. Users sign in with an email address and a password. Passwords are stored as bcrypt hashes in your database. The first administrator sets their own password at first sign-in. SSO is available if your license includes it.
• Email through your SMTP server, for account emails and client communication.
• File storage in an S3-compatible store: Silo (a maintained MinIO fork) is included, or point the install at any S3-compatible service.
• The Vulnsy library: finding templates, report styles, DOCX export templates, email templates and more, installed on first start and updated by upgrades.
• Upgrades on your schedule. Each release is a versioned package, and you choose when to install it.
• An installer that sets up the server, and upgrades, backs up and restores the installation.

What Is Not Included

• Billing and subscriptions. A license from Vulnsy takes their place. It sets the expiry date, the user limit, and the modules and features available. See Licensing.
• Sign-up, trials and the vulnsy.com website. These pages do not exist on a self-hosted server.
• Vulnsy-managed AI. The AI assistant works with your own OpenRouter key or your own model endpoint.
• Email delivery and file hosting by Vulnsy. You provide the SMTP server, and files stay in your own store.

Architecture

                          Users' browsers
                                │
           ┌────────────────────┴────────────────────┐
           │ https://APP_HOST                        │ https://FILES_HOST
           ▼                                         ▼
┌────────────────────────────────────────────────────────────────────┐
│  Caddy: TLS on ports 80 and 443 (or your own reverse proxy)        │
└────────────────────────────────────────────────────────────────────┘
           │                                         │
           ▼                                         ▼
    Vulnsy app :3000 ──────────── S3 API ────────▶ MinIO :9000
           │                                      (uploaded files)
           ▼
    PostgreSQL 16 :5432
    (vulnsy_control, vulnsy_shared, vulnsy_tenant)

The app reaches PostgreSQL and MinIO over the internal Docker network. Browsers download files directly from MinIO through the files host, using short-lived signed links that the app creates.

Requirements

Network

Next Steps