OWASP Security Shepherd

Next release: 4.0.0

4.0.0 brings Security Shepherd back into a usable, maintainable state. Its dependencies are brought up to date so they can be maintained again, the codebase moves to a modern stack that contributors can work on, and the bugs that stopped the platform working or exhausted its database are fixed. The levels stay vulnerable on purpose.

It also replaces the old mobile apps with a single, modern Android app that works on current devices, so the mobile levels no longer need the old Mobile VM.

Under the hood, it moves to Java 17, Jakarta EE 11 on Tomcat 11 and MariaDB 12.3, rebuilds single sign-on on pac4j, and publishes signed Docker images for amd64 and arm64 with an SBOM and build provenance. The move to MongoDB 8.0 is still to come. The 4.0.0 milestone and release checklist, linked below, track what's left.

After 4.0.0

The plan for the 4.x releases and 5.0 is under discussion, and we'd like your input. The draft focuses on restructuring the backend, making it quick to set up a class, a simpler translation workflow, and theming, starting with dark and light mode. Join the roadmap discussion, linked below.

Get involved

Security Shepherd is developed by a worldwide team of volunteers, and new levels and level ideas are always welcome. Translations are a good place to start, since most languages are far from complete: see the wiki page on how to add a new language. To add a level, see the wiki page on how to make a Security Shepherd level. For anything else, browse the issues on GitHub. All of these are linked below.