GSoC 2026 Ideas

Bug Logging Tool (BLT) • OWASP DevSecOps Maturity Model • OWASP Nettacker • OWASP Nest • OWASP Juice Shop • Pygoat • OpenCRE • OWASP OWTF • OWASP Cornucopia

Tips to get you started in no particular order:

List of Project Ideas

Bug Logging Tool (BLT)

OWASP BLT (Bug Logging Tool) is a community-driven OWASP Foundation project that develops and maintains open-source tools for structured vulnerability reporting, bug tracking, security automation, contributor engagement, and related infrastructure. The BLT ecosystem includes modular services, APIs, dashboards, browser and mobile applications, automation bots, and research initiatives, all developed transparently under OWASP governance and open-source licensing.

BLT has evolved into a growing ecosystem that combines modern full-stack engineering, AI-assisted security workflows, hands-on security education, distributed scanning infrastructure, and blockchain-backed incentive systems. The platform functions both as a production-grade vulnerability management system and as a practical learning environment where contributors build real-world security expertise.

This year’s GSoC projects center on core platform modernization, AI-native interfaces, automation-first workflows, distributed security infrastructure, hands-on security education, and meaningful gamification. Our goal is to make BLT faster, more scalable, AI-agent ready, and deeply educational—turning real security work into structured learning pathways.

Preference will be given to students who have at least 5 merged PRs before GSoC selection.

🔹 2026 GSoC Ideas / All Large Projects

BLT-Next : Core BLT Migration to GitHub Pages and Cloudflare Python workers

Revamp BLT website with a fresh, modern design by removing non-core components to create a clear, enjoyable user experience focused on core value. The project involves migrating the complete OWASP BLT platform from its current Django-based monolithic architecture to a lightweight static frontend deployed on GitHub Pages using plain HTML, vanilla JavaScript, and HTMX, with dynamic functionality powered by Cloudflare Python Workers at the edge. This migration will replace Django template rendering with modular static components and progressive enhancement, achieving sub-200ms global response times, simplified architecture, improved maintainability, and production-grade reliability while preserving full feature parity and positioning BLT as a fast, contributor-friendly reference implementation.

BLT-Preflight : Pre-Contribution Security Intent & Risk Guidance

Provide security intent and risk guidance before contributors submit code to prevent common mistakes and improve contributor understanding. This pre-contribution advisory system helps contributors understand security expectations before opening a pull request by evaluating security context through issue labels, repository metadata, and historical patterns, then providing plain-language guidance linked to relevant documentation. The system includes optional contributor intent capture (planned work areas, components to modify, AI assistance usage), a maintainer visibility dashboard for early identification of risky contributions, and a learning feedback loop that refines guidance rules over time. BLT-Preflight operates on a purely advisory basis with no blocking or enforcement mechanisms, focusing on prevention and clarity to reduce maintainer workload and improve the quality of security contributions.

BLT-Rewards : BACON Rewards & Security Contribution Gamification

Security contribution gamification with BACON tokens, badges, reputation tiers, and leaderboards to increase contributor retention and engagement. The system listens for verified security contributions and awards rewards idempotently including BACON cryptocurrency tokens (with existing blockchain mint infrastructure), achievement badges for different security domains, progressive reputation tiers (Beginner → Expert), severity-weighted leaderboards, and a swag redemption marketplace where tokens convert to physical merchandise. Built with robust anti-gaming architecture (idempotent rewards, fraud detection, admin oversight), the platform includes comprehensive audit trails, an education bridge API layer for learning platform integration, and tokenomics analysis to ensure long-term sustainability. BLT-Rewards transforms security work into an engaging, progression-based experience that prioritizes impact over volume while enabling education platforms to leverage BLT contribution data for personalized learning paths.

BLT-NetGuardian : Distributed Autonomous Security Scanning Platform

Community-powered security scanning platform with distributed scanning, real vulnerability detection, and responsible disclosure workflows. NetGuardian replaces stubbed scanners with real vulnerability detection (XSS, SQLi, CSRF, security headers plus Semgrep SAST), introduces distributed scanning via secure volunteer CLI clients with local resource caps, and implements Zero-Trust encrypted ingestion where sensitive evidence stays encrypted end-to-end until authorized organization users decrypt it client-side. The platform includes result validation and false-positive filtering with confidence scoring, basic deduplication using fingerprints, triage-lite UI with evidence viewer and “Convert to Issue” workflow, security.txt detection for improved responsible disclosure, and professional remediation reports (CSV/PDF) for organizations. NetGuardian emphasizes accuracy through curated evaluation targets and rule tuning, privacy-preserving architecture with signed and timestamped submissions, and lower reviewer workload through normalized findings and streamlined triage.

BLT University : Security-Focused Education Platform

Security-focused education tool that teaches users about security through hands-on, code-centric labs and community-driven knowledge sharing. The platform transforms BLT’s existing theory-heavy labs into interactive exercises where learners analyze real vulnerable code, identify security flaws, explain exploitation scenarios, and apply secure fixes using a three-step workflow (Identify → Explain → Fix) with partial credit and progress tracking. BLT University establishes a safe, anonymized security intelligence pipeline that aggregates vulnerability patterns from BLT issues/PRs into public dashboards, monthly/quarterly reports with two-person approval workflows, and remediation playbooks that convert into mini interactive challenges. The unified architecture creates a feedback loop where real vulnerability patterns improve labs and playbooks, helping contributors learn security thinking inspired by OWASP Top 10 and CTF-style reasoning, with optional integration to badges/BACON gamification and future connections to NetGuardian findings for automatically mapped learning recommendations.

BLT-MCP : Model Context Protocol Server for Complete BLT Interface

An interface to the BLT ecosystem enabling AI agents and developers to log bugs, triage issues, query data, and manage workflows from IDEs or chat interfaces. BLT-MCP implements the Model Context Protocol (MCP) standard to provide comprehensive, AI-agent-friendly access to all aspects of BLT through three layers: Resources (read-only access to issues, repos, contributors, workflows, leaderboards, rewards via blt:// URIs), Tools (actions like submit_issue, award_bacon, update_issue_status, add_comment), and Prompts (reusable task templates like triage_vulnerability, plan_remediation, review_contribution). The system uses JSON-RPC 2.0 over stdio or HTTP/SSE with OAuth 2.0/API key authentication, enabling natural integration with Claude Desktop, custom AI agents, and third-party tools without requiring custom API documentation since agents discover capabilities automatically. BLT-MCP positions BLT as an AI-agent-first platform with standardized protocol access that unifies fragmented REST/GraphQL endpoints, creates novel use cases (autonomous issue triage, automated reward distribution, workflow tracking), and synergizes with other BLT ideas by exposing RAG bot capabilities, AI-guided recommendations, reputation scores, and gamification data through a single consistent interface.

✅ Expected Results

📌 Knowledge Prerequisites

To contribute effectively, familiarity with at least one or more of the following is recommended:

👥 Mentors

📌 Confirmed Mentors: (we’re all on the OWASP Slack in the #project-blt channel)

OWASP DevSecOps Maturity Model

Join us in enhancing the DSOMM, a pivotal tool designed to improve the security and operational efficiency of software development processes. We are looking for passionate students to contribute to two major areas: our main application development in JavaScript and our metric analyzer and collector in Java. Whether you are looking to tackle medium-sized challenges or are ready to embark on a larger project, we have exciting opportunities for you.

To receive early feedback please:

Update of the DSOMM Application (Angular)

Preferred for "Large" GSoC 2026 project Primary Objectives:

Prerequisites

Mentors

Reach out to us on Slack to discuss these and other ideas!

OWASP Nettacker

OWASP Nettacker is a Modular Automated Penetration Testing/ Information gathering Framework and Vulnerability Scanner fully written in Python. Nettacker can run a variety of scans discovering subdomains, open ports, services, vulnerabilities, misconfigurations, default credentials.

Difficulty: Medium Preferred for "Medium" GSoC 2026 project

Explanation of Ideas
Your Own Ideas

Do you have an idea to improve OWASP Nettacker? We’d love to hear it, please reach out in OWASP Slack on channel #project-nettacker to ensure that the idea fits OWASP Nettacker roadmap and goals.

Getting Started

Repositories:

Knowldege Requirements
Mentors

OWASP Nest

OWASP Nest is a comprehensive, community-first platform built to enhance collaboration and contribution across the OWASP community. Acting as a central hub, it helps users discover chapters and projects, find contribution opportunities, and connect with like-minded individuals based on their interests and expertise.

Repositories

Technical Stack

Getting Started

Projects / Ideas

Possible for "Small" GSoC 2026 project Preferred for "Medium" GSoC 2026 project Possible for "Large" GSoC 2026 project

Please visit our planned milestones page or gsoc2026 labeled issues page.

Your own ideas

Do you have an idea to improve OWASP Nest? We’d love to hear it, please reach out in Slack to ensure that the idea fits OWASP Nest goals.

Expected Results

Mentors

Please contact Arkadii Yakovets or Kate Golovanova if you’re interested in participating as a mentor.

Arkadii Yakovets
Arkadii Yakovets
Cybersecurity Lead, CCSP, CISSP, CSSLP | OWASP Nest Project Leader
GitHub • LinkedIn • Slack
Illia Oleksiuk
Illia Oleksiuk
DevOps Engineer at Pow.bio
GitHub • LinkedIn • Slack
Ime Iyonsi
Ime Iyonsi
Software Engineer / Application Security Engineer, CC, GSEC
GitHub • LinkedIn • Slack
Kateryna Golovanova
Kate Golovanova
Senior Software Engineer at Skill Struck, CC | OWASP Nest Project Leader
GitHub • LinkedIn • Slack
Kerlyn Manyi
Kerlyn Manyi
Cybersecurity Engineer | GSoC'25 mentor at Mifos Initiative
GitHub • LinkedIn • Slack
Keshav Malik
Keshav Malik
Senior Security Engineer at LinkedIn
GitHub • LinkedIn • Slack
Kriti Birda
Kriti Birda
AI/ML enthusiast | GSoC'25 contributor at PSF
GitHub • LinkedIn • Slack
Marie Wang
Marie Wang
Senior GRC & Technology Risk Leader, CISSP
GitHub • LinkedIn • Slack
Noland Crane
Noland Crane
Application Security Analyst at Bloomreach, CISSP
GitHub • LinkedIn • Slack
Raja Nagori
Raja Nagori
Product Security Engineer at Splunk
GitHub • LinkedIn • Slack

OWASP Juice Shop

OWASP Juice Shop is probably the most modern and sophisticated insecure web application! It can be used in security trainings, awareness demos, CTFs and as a guinea pig for security tools! Juice Shop encompasses vulnerabilities from the entire OWASP Top Ten along with many other security flaws found in real-world applications!

To receive early feedback please:

🛑 Please be aware that the OWASP Juice Shop project will not consider or even review any proposals which fail to include an AI Tool Disclosure statement. We recommend you use the following templated that we derived from the one enforced on Pull Requests to OWASP Juice Shop:

### AI Tool Disclosure

- [ ] My GSoC proposal does not include any AI-generated content
- [ ] My GSoC proposal includes AI-generated content, as disclosed below:
  - AI Tools: `[e.g. GitHub CoPilot, ChatGPT, JetBrains Junie etc.]`
  - LLMs and versions: `[e.g. GPT-4.1, Claude Haiku 4.5, Gemini 2.5 Pro etc.]`
  - Prompts: `[Summarize the key prompts or instructions given to the AI tools]`
Explanation of Ideas
Your own idea

Preferred for "Medium" GSoC 2024 project Preferred for "Large" GSoC 2024 project

Difficulty: Easy Difficulty: Medium Difficulty: Hard

You have an awesome idea to improve OWASP Juice Shop that is not on this list? Great, please submit it!

Expected Results
Getting started
Mentors

PyGoat

PyGoat is an open-source, intentionally vulnerable Python web application designed to help developers and security enthusiasts learn about web application security. It provides hands-on experience in identifying and mitigating common security vulnerabilities, making it a valuable resource for practicing secure coding and penetration testing techniques.

Repository

Skills Required

Getting started

Projects / Ideas

Preferred for "Medium" GSoC 2026 project Preferred for "Large" GSoC 2026 project Difficulty: Medium

Mentors

OpenCRE

OpenCRE is the world’s largest Cybersecurity knowledge graph. It semantically links information between standards, knowledge bases and security tools. Also, it allows users to extend the graph themselves and contains a RAG chatbot implementation. OpenCRE is a great GSOC project if you’re looking to add “Data science/engineering”, “Knowledge Graph and AI” with a focus on Legal Tech and cybersecurity in your CV.

Repository

Skills Required

Getting started

Projects / Ideas

Preferred for "Medium" GSoC 2026 project Preferred for "Large" GSoC 2026 project Difficulty: Medium

🔹 OpenCRE Scraper & Indexer (Project OIE) - Module Projects

The OpenCRE Scraper & Indexer is an autonomous ETL pipeline that ingests OWASP security knowledge from various sources, filters noise, and links content to the OpenCRE knowledge graph. This project consists of four independent modules, each suitable for a GSoC project.

Important Requirements:

For detailed architecture and requirements, see the RFC: The OpenCRE Scraper & Indexer.

🔸 Module A: Information Harvesting

Preferred for "Medium" GSoC 2026 project Difficulty: Medium

Primary Objectives:

Technical Requirements:

Expected Results:

Difficulty Characterization: This is a Medium difficulty project requiring:

🔸 Module B: Noise/Relevance Filter

Preferred for "Medium" GSoC 2026 project Difficulty: Easy

Primary Objectives:

Technical Requirements:

Expected Results:

Difficulty Characterization: This is an Easy difficulty project suitable for:

🔸 Module C: The Librarian (Smart Content Mapping)

Preferred for "Large" GSoC 2026 project Difficulty: Hard

Primary Objectives:

Technical Requirements:

Expected Results:

Difficulty Characterization: This is a Hard difficulty project requiring:

Bonus/Pro-Mode: Implement Hybrid Search (Vector + Keyword/BM25) for exact keyword matching (e.g., CVE IDs).

🔸 Module D: Human-in-the-Loop (HITL) & Logging

Preferred for "Medium" GSoC 2026 project Difficulty: Easy

Primary Objectives:

Technical Requirements:

Expected Results:

Difficulty Characterization: This is an Easy difficulty project suitable for:

Bonus/Pro-Mode: Implement “Loss Warehousing” to capture structured loss events (Input + Wrong Prediction + Correct Label) for future model retraining.

Mentors

For OpenCRE Scraper & Indexer (Project OIE) Module Projects (A, B, C, D):

OWTF

OWTF attempts to solve the “penetration testers are never given enough time to test properly” problem, or in other words, OWTF = Test/Exploit ASAP, with this in mind, as of right now, the priorities are:

Repository

Skills Required

Getting started

Please use the repositories’ issue tracker, GitHub discussions, and don’t forget to read the contributing guide. Join the community at #owtf on OWASP Slack and share your questions, project ideas.

To receive early feedback please:

Projects / Ideas

Preferred for "Medium" GSoC 2026 project Difficulty: Hard OWTF Modernization

OWTF has evolved over time, but parts of the codebase are outdated, have technical debt, and may not be optimized for newer Python versions or best practices. This project aims to modernize the OWTF codebase, ensuring long-term maintainability, security, and efficiency. Key Objectives

  1. Fix Long-Standing Bugs & Improve Stability
    • Audit and resolve GitHub issues related to stability, crashes, and performance bottlenecks.
    • Enhance logging and error handling for better debugging.
    • Improve unit tests and CI/CD pipelines to catch regressions early.
  2. Optimize Plugin Execution & Dependency Management
    • Upgrade outdated third-party security tools used in plugins.
    • Reduce dependency bloat by removing redundant libraries.
    • Use async execution where applicable for better performance.
Expected Outcomes

✔️ OWTF will be cleaner, faster, and easier to maintain.
✔️ The project will be future-proofed with up-to-date dependencies.
✔️ Stability and performance will be significantly improved.

Preferred for "Medium" GSoC 2026 project Difficulty: Hard MiTM proxy upgrade

OWTF’s proxy was written almost 10 years ago based on the Tornado Web Framework. It is in rough shape and needs a lot of improvement on the transaction recording, storing, and modification side. We want to make it as good as MiTM proxy.

Expected Outcomes

✔️ Modern mitm proxy that allows modificaiton of requests and responses on the fly
✔️ Better integration with the framework to record a variety of requests and responses.
✔️ Stability and performance.

Mentors

OWASP Cornucopia

Repository

Skills Required

Getting started

Projects / Ideas

Preferred for "Medium" GSoC 2026 project Difficulty: Medium

Mentors