Our take
Activeregular commits and releases- Activity
- 75
- Community
- 60
- Issues
- 70
- Pull requests
- 41
- More contributors than 77% of the projects we track
Juice Shop is an actively maintained, MIT-licensed training target with regular commits and releases, but its contributor activity is heavily concentrated in one person.
Good fit if
- You need a deliberately vulnerable web application for security training, CTFs, or tool testing.
- Your team can run a Node.js application or Docker container and wants an accompanying guide to the challenges.
- You want an MIT-licensed project with recent releases and responsive issue and pull-request handling.
Look elsewhere if
- You need a production-safe storefront rather than an intentionally insecure training application.
- Your environment cannot support Node.js 22–26 or Docker-based deployment.
- Your project requires maintainer activity to be broadly distributed, since most contributions come from one person.
All health signals
| Last commit | 2026-10-23 (1 day ago) |
|---|---|
| Commits, last 90 days | 100+ |
| Releases, last 12 months | 9 (latest v20.3.0, 2026-10-11) |
| Contributors | 100+ (top contributor: 86% of commits) |
| Issues closed, last 90 days | 14+ (typically closed in 2 days) |
| Pull requests merged, last 90 days | 14 (typically merged in 2 days) |
| Project age | 12 years |
Checked on 2026-10-24 with the GitHub API.
Overview
OWASP Juice Shop is a deliberately insecure web application built with TypeScript. It gives security learners and practitioners a realistic target for exploring vulnerabilities across the OWASP Top Ten and other flaws found in real-world applications.
The project is intended for security training, awareness demonstrations, CTFs, and testing security tools. It can run locally from source, as a packaged application, or in Docker, and includes an official companion guide with vulnerability explanations and challenge solutions.
Key Features
- Covers vulnerabilities from the OWASP Top Ten alongside other application security flaws.
- Provides challenges for hands-on security practice and CTFs.
- Supports local setup from source with Node.js, packaged distributions, and Docker.
- Offers an official companion guide with hints, explanations, and challenge solutions.
- Documents CTF support, trainer guidance, and custom rebranding.
- Includes some challenges that require configuration of an AI/LLM provider.
Use Cases
- Security trainers can use it for guided exercises and awareness demonstrations.
- CTF organizers can use its challenge environment for hands-on events.
- Learners can practice finding and understanding web application vulnerabilities in a purpose-built target.
- Security-tool developers can use it as a test application when evaluating their tools.
What you need
Detected in the repository
- Node.js 22 - 26 (from package.json)
- A Dockerfile, so it can run in a container
- A test suite and automated checks on GitHub Actions
License in plain words
MITpermissive
- Commercial use: yes
- Modify and redistribute: yes
- You must keep: the copyright and license notice
- Share your changes: no
A summary, not legal advice: the LICENSE file is what applies.
Getting Started
With Node.js installed, clone the repository, install dependencies, and start the app:
git clone https://github.com/juice-shop/juice-shop.git --depth 1
cd juice-shop
npm install
npm start
Open http://localhost:3000. See the README for packaged, Docker, and other setup options.
Alternatives
- DVWA: DVWA is a PHP/MariaDB app focused on common vulnerabilities with selectable difficulty levels, while Juice Shop is built with TypeScript and spans broader challenges.
- vuln-bank: Vuln Bank centers on banking scenarios across web, API, GraphQL, and AI features, while Juice Shop covers a broader range of application security challenges.
| Project | Language | License | Stars | Status |
|---|---|---|---|---|
| juice-shop | TypeScript | MIT | 14.2k | Active |
| DVWA | PHP | GPL-3.0 | 13.9k | Active |
| vuln-bank | HTML | MIT | 960 | Maintained |
Considerations
This is intentionally insecure software. Treat it as a training target, not as a production shop, and avoid exposing it as a public hacking target. The project documents Node.js 22–26 as supported; some challenges also depend on configuring an AI/LLM provider. Although the project has regular releases and active issue handling, its contributor activity is concentrated in one person, which is a continuity risk to consider. The application is under the MIT license; the companion guide has a separate CC BY-NC-ND 4.0 license.
Found this useful?
Share it with someone who would like juice-shop.