# NodeGoat: Learn OWASP Top 10 Security in Node.js Apps This repository profile is provided by osrepos.com, an open source repository discovery platform. Source: osrepos.com Repository profile: https://osrepos.com/repo/owasp-nodegoat Generated for open source discovery and AI-assisted research. OWASP NodeGoat is a Node.js web application for learning how OWASP Top 10 risks affect web apps and how to address them. It pairs a deliberately vulnerable app with tutorials for hands-on security practice. GitHub: https://github.com/OWASP/NodeGoat OSRepos URL: https://osrepos.com/repo/owasp-nodegoat ## Summary OWASP NodeGoat is a Node.js web application for learning how OWASP Top 10 risks affect web apps and how to address them. It pairs a deliberately vulnerable app with tutorials for hands-on security practice. ## Topics - security - javascript - web-app - education - owasp-top-ten - vulnerable-web-app ## Repository Information Last analyzed by OSRepos: Sun Oct 25 2026 02:28:25 GMT+0000 (Western European Standard Time) Detail views: 0 GitHub clicks: 0 ## Safety Notice OSRepos shares public repositories for knowledge and discovery only. Review source code, dependencies, licenses, and security implications before running or installing anything. ## Content ## Overview OWASP NodeGoat is a Node.js web application built to teach how OWASP Top 10 security risks apply to Node.js web apps and how to address them. It provides a deliberately vulnerable environment where developers and security learners can explore vulnerabilities, then practice fixing them. The project is aimed at people learning application security, including developers who want examples tied to Node.js rather than abstract guidance. It includes a tutorial and can run locally with MongoDB, in Docker, or on Heroku. ## Key Features - Deliberately vulnerable Node.js application for hands-on security exercises. - Built-in tutorial explaining OWASP Top 10 vulnerabilities and ways to fix them. - Source-code comments that help learners locate vulnerability examples. - MongoDB seed data with admin and standard user accounts. - Local setup with Node.js and MongoDB, or Docker Compose with app and database services. - Heroku deployment instructions for a hosted learning environment. ## Use Cases - Node.js developers can study common web application risks in an app built on their platform. - Security instructors can use the tutorial and vulnerable app for practical OWASP Top 10 exercises. - Application security learners can test vulnerabilities and try fixes in a controlled environment. - Teams can run a shared Docker-based instance for internal training, provided it is kept separate from production systems. ## Our Take NodeGoat remains a useful, focused security-learning lab, but its inactive maintenance makes it less suitable as a current reference for production Node.js practices. **Good fit if:** - You want a hands-on introduction to OWASP Top 10 risks in Node.js applications. - You can run and manage the app with MongoDB, or use its Docker Compose setup. - You need an educational lab and can account for its lack of recent maintenance. **Look elsewhere if:** - You need an actively maintained application, as the project has had no commits in over a year and no recent releases. - Your team expects regular issue or pull request activity. Recent issue closures have been limited, and no pull requests were merged in the measured period. - You need a production-ready application rather than an intentionally vulnerable training target. ## Project Health | Signal | Value | |---|---| | Status | **Inactive**: no commits in over a year | | Last commit | 2024-06-15 (2.4 years ago) | | Commits, last 90 days | 0 | | Releases, last 12 months | 0 (latest v1.4, 2019-08-04) | | Contributors | 30 (top contributor: 39% of commits) | | Issues closed, last 90 days | 1 | | Pull requests merged, last 90 days | 0 | | Project age | 13 years | Checked on 2026-10-25 with the GitHub API. ## Project Facts - Language: HTML - License: Apache-2.0 - Stars: 2.1k - Forks: 3.1k - Topics: docker, heroku, javascript, nodegoat, nodejs, owasp-top-ten, owasp-zap, vulnerabilities - Website: https://www.owasp.org/index.php/Projects/OWASP_Node_js_Goat_Project - Archived: no ## What You Need Detected in the repository: - Node.js (from package.json) - A Dockerfile, so it can run in a container; a Compose file sets up the related services - A test suite and automated checks on GitHub Actions ## Getting Started With Node.js and MongoDB available, follow the README for database setup, configuration, and other options: ```sh git clone https://github.com/OWASP/NodeGoat.git cd NodeGoat npm install npm run db:seed npm start ``` The app starts at `http://localhost:4000/` by default. See the [README](https://github.com/OWASP/NodeGoat#readme) for Docker, Heroku, and configuration details. ## License in Plain Words **Apache-2.0** (permissive). - Commercial use: yes - Modify and redistribute: yes - You must keep: the license, the NOTICE file and a note of your changes - Share your changes: no - Includes an explicit patent grant from the contributors A summary, not legal advice: the LICENSE file is what applies. ## Alternatives - [juice-shop](https://osrepos.com/repo/juice-shop-juice-shop): Juice Shop offers a broader, challenge-driven training app for CTFs and security-tool testing, while NodeGoat pairs its vulnerable Node.js app with guided tutorials. - [vuln-bank](https://osrepos.com/repo/commando-x-vuln-bank): Vuln Bank focuses on banking scenarios across web, API, GraphQL, and AI, while NodeGoat teaches OWASP risks through a Node.js app and tutorials. - [DVWA](https://osrepos.com/repo/digininja-dvwa): DVWA is a PHP/MariaDB app with configurable difficulty for practicing common vulnerabilities, while NodeGoat uses Node.js and tutorial-led OWASP learning. | Project | Language | License | Stars | Status | |---|---|---|---|---| | **NodeGoat** | HTML | Apache-2.0 | 2.1k | Inactive | | [juice-shop](https://osrepos.com/repo/juice-shop-juice-shop) | TypeScript | MIT | 14.2k | Active | | [vuln-bank](https://osrepos.com/repo/commando-x-vuln-bank) | HTML | MIT | 960 | Maintained | | [DVWA](https://osrepos.com/repo/digininja-dvwa) | PHP | GPL-3.0 | 13.9k | Active | ## Considerations - The app is intentionally vulnerable. Use it only as a learning environment, and do not expose it as a production service. - A MongoDB instance is required for the documented local setup. Docker Compose can bring up the app and database together. - The README describes Node.js 8 or above, but this guidance may be dated given the project's inactive status. Check runtime compatibility before setting up a current environment. - The repository has no commits in over a year and no releases in the past year. It has 30 contributors, with work not concentrated mostly in one person, but recent issue handling and pull request activity are limited. - The project uses the Apache-2.0 license; review its terms when incorporating or redistributing code.