OWASP BLT
OWASP BLT (Bug Logging Tool) is a community-driven OWASP Foundation project that develops and maintains open-source tools for structured vulnerability reporting, contributor rewards and security education. Every BLT project lives in this one repository, each in its own folder, with its full commit history.
git.owaspblt.org is the official source of truth for BLT. Please do all work there: clone from it, open
issues and pull requests there, and discuss there. github.com/OWASP/BLT is a
read-only mirror kept as a backup. It updates automatically, but issues and pull requests aren't accepted on it.
Getting started
git clone https://git.owaspblt.org/BLT.git
cd BLT/<project> # e.g. blt-leaf; each project has its own README
Deploy a project with scripts/deploy.sh <project>, or every Cloudflare project with scripts/deploy.sh --all. See Deploying.
Using AI
BLT is a pro-AI project: coding agents and AI assistants are welcome for issues, pull requests, tests and docs. Every BLT issue has a one-line copy AI prompt you can paste into your agent to start work. You stay responsible for the result. Before you submit, review every change, run scripts/ci/test.sh <project>, and fill in the pull request's AI model field (or put None). Never paste secrets or private vulnerability details into AI services. Read the full AI Policy before you contribute.
Contributing and project policies
| |
|---|
| Contributing | Fork, branch and pull request on git.owaspblt.org; tests, commit conventions, good first issues |
| AI Policy | How to use AI tools; every pull request states the AI model used |
| Security Policy | Report vulnerabilities privately through the repository's Security tab, never in a public issue |
| Code of Conduct | The OWASP Code of Conduct applies everywhere BLT works |
| Support | Where to ask questions: issues, discussions, #project-blt on the OWASP Slack |
| Governance | Project lead, maintainers, decisions and community leadership elections |
| License | Each project has its own licence; most are AGPL-3.0 |
This is the beginning of the README. Read the rest at the original. Read the full README ↗
