OWASP BLT (Bug Logging Tool) is a community-driven OWASP Foundation project that develops and maintains open-source tools for structured vulnerability reporting, contributor rewards and security education. Every BLT project lives in this one repository, each in its own folder, with its full commit history.
git.owaspblt.org is the official source of truth for BLT. Please do all work there: clone from it, open issues and pull requests there, and discuss there. github.com/OWASP/BLT is a read-only mirror kept as a backup. It updates automatically, but issues and pull requests aren't accepted on it.
- Home: git.owaspblt.org/BLT: issues, pull requests and discussions happen here
- Mirror (read-only backup): github.com/OWASP/BLT
- Website: owaspblt.org
git clone https://git.owaspblt.org/BLT.git
cd BLT/<project> # e.g. blt-leaf; each project has its own READMEDeploy a project with scripts/deploy.sh <project>, or every Cloudflare project with scripts/deploy.sh --all. See Deploying.
BLT is a pro-AI project: coding agents and AI assistants are welcome for issues, pull requests, tests and docs. Every BLT issue has a one-line copy AI prompt you can paste into your agent to start work. You stay responsible for the result. Before you submit, review every change, run scripts/ci/test.sh <project>, and fill in the pull request's AI model field (or put None). Never paste secrets or private vulnerability details into AI services. Read the full AI Policy before you contribute.
| Contributing | Fork, branch and pull request on git.owaspblt.org; tests, commit conventions, good first issues |
| AI Policy | How to use AI tools; every pull request states the AI model used |
| Security Policy | Report vulnerabilities privately through the repository's Security tab, never in a public issue |
| Code of Conduct | The OWASP Code of Conduct applies everywhere BLT works |
| Support | Where to ask questions: issues, discussions, #project-blt on the OWASP Slack |
| Governance | Project lead, maintainers, decisions and community leadership elections |
| License | Each project has its own licence; most are AGPL-3.0 |
| Project | What it is | Live site |
|---|---|---|
| BLT-Action | Issue automation for BLT: /assign and /unassign on git.owaspblt.org issues and the daily release of stale claims (forge workflows), plus the original GitHub Action for other repositories. | |
| BLT-API | REST API for OWASP BLT, written in Python on Cloudflare Workers: bugs, users, domains, organizations, projects, bug hunts, leaderboards and statistics. | api.owaspblt.org |
| BLT-Autopatch | Automated patching: proposes fixes for detected security issues. | |
| BLT-Byte | AI-powered assistant for bug bounty hunting and security research on the BLT (Bug Logging Tool) platform. | byte.owaspblt.org |
| BLT-CLI | Terminal (TUI) client for OWASP BLT, written in Rust with Ratatui: browse and triage issues, follow bug hunts and submit vulnerability reports, directly against the BLT API or through BLT-MCP. | |
| blt-core | The main OWASP BLT platform: a Django app for gamified, crowd-sourced bug reporting and vulnerability disclosure across websites, apps and Git repositories. | owaspblt.org |
| BLT-Cron | Cloudflare Worker that holds the account's only cron trigger and runs every BLT Worker's scheduled job on that job's own schedule, through service bindings. | |
| BLT-CVE | Community vulnerability registry under the BLT-YYYY-NNNN namespace, published as static, machine-readable JSON on Cloudflare with no backend. | cve.owaspblt.org |
| BLT-Dash | A company cybersecurity dashboard that integrates with everything and gives a heads-up display single page of everything you need to see. | dash.owaspblt.org |
| BLT-Design | Static BLT design system for light/dark mode, logos, colors, typography, and copy-paste component patterns. | design.owaspblt.org |
| BLT-Design-Contest | Community design showcase for OWASP BLT. | contest.owaspblt.org |
| BLT-Docs | MkDocs source of the OWASP BLT documentation: user workflows, contributor guidance, API notes and platform maintenance. | docs.owaspblt.org |
| BLT-Enforcement | IP and trademark defense tools: trademark name checks and repository comparison for code similarity and license issues. | enforcement.owaspblt.org |
| BLT-Extension | Chrome extension that takes screenshots of whole pages or selected areas and adds them to the BLT website. | extension.owaspblt.org |
| BLT-Flutter | OWASP BLT mobile app in Flutter: report bugs, browse issues and leaderboards, and join bug hunts. | flutter.owaspblt.org |
| BLT-Gitcaster | Live leaderboard of GitHub repository activity with AI-generated, sportscaster-style commentary on each event. | gitcaster.owaspblt.org |
| BLT-GSOC | This repository contains the Google Summer of Code (GSoC) pages for the OWASP BLT project, hosted as a static GitHub Pages site. | gsoc.owaspblt.org |
| BLT-Hackathons | A static hackathon platform for the BLT projects on git.owaspblt.org (and GitHub or GitLab projects) with charts, leaderboards, and prizes. | hackathons.owaspblt.org |
| BLT-HackerHouse | Real-time contributor visualization platform for OWASP BLT — now running on Cloudflare Workers. | hackerhouse.owaspblt.org |
| BLT-Home | The owaspblt.org landing page: what OWASP BLT is, live project numbers, every live BLT product, and how to get involved. | owaspblt.org |
| BLT-Ideas | Brainstorming proposals for future OWASP BLT development, each scoped to one 350-hour project slot; community direction, not commitments. | ideas.owaspblt.org |
| BLT-Jobs | Git-native job board for the OWASP BLT ecosystem: job listings and seeker profiles are Markdown files in this folder, published as a static site. | jobs.owaspblt.org |
| BLT-Ketchup | Real-time collaboration workspace for penetration testing teams: shared findings, CVSS scoring, evidence and escalation to BLT. | ketchup.owaspblt.org |
| BLT-Leaf | A simple one-page application to track and monitor GitHub Pull Request readiness status. | leaf.owaspblt.org |
| BLT-Legacy | BLT Legacy is the original OWASP BLT Django app (formerly BLT-Core). It is being replaced, feature by feature, by the newer BLT projects. | legacy.owaspblt.org |
| BLT-Lettuce | Slack bot for the OWASP community, running on Cloudflare Workers: welcome messages for new members, project discovery and contributor help. | lettuce.owaspblt.org |
| BLT-Mayo | Read-only Linux security auditing tool (Monitor, Analyze, Yield, Observe) that scans filesystem artifacts for dangerous shell execution and reports explainable findings. | |
| BLT-MCP | MCP (Model Context Protocol) server that gives AI agents and IDEs structured access to OWASP BLT: log bugs, triage issues and query data. | mcp.owaspblt.org |
| BLT-Monitor | Website monitor on Cloudflare Python Workers: checks availability and keywords every twenty minutes, keeps recent history in Workers KV and alerts Slack. | monitor.owaspblt.org |
| BLT-NetGuardian | Signed findings ingest + distributed domain crawl + org triage + BLT convert, on Cloudflare Workers (D1). | netguardian.owaspblt.org |
| BLT-NetGuardian-Client | Flutter client for BLT NetGuardian: queue and track security scan tasks, register targets and review discovered vulnerabilities. | |
| BLT-Newsletter | OWASP BLT newsletter platform: a Python Cloudflare Worker with D1 storage, an admin dashboard for subscribers and campaigns, and SendGrid delivery. | newsletter.owaspblt.org |
| BLT-Next | A fresh, modern design by removing non-core components to create a clear, enjoyable user experience focused on core value | next.owaspblt.org |
| BLT-Nexus | Directory of security projects connected to OWASP BLT and the BLT ambassadors who represent them. | nexus.owaspblt.org |
| BLT-OSSH | Open-Source Sorting Hat — AI-powered GitHub profile analyzer that recommends perfect open-source projects for contributors. | ossh.owaspblt.org |
| BLT-OWASP-Bumper | Daily-generated dashboard of every repository in the OWASP GitHub organization, with activity sparklines and project metadata. | bumper.owaspblt.org |
| BLT-OWASP-Metadata | Collects and standardizes metadata for OWASP projects and chapters from the front matter of their index.md files, with a browsable dashboard. | metadata.owaspblt.org |
| BLT-OWASP-Projects | A static dashboard for tracking OWASP project repositories, repository status, and open issues. | projects.owaspblt.org |
| BLT-OWASP-Wich | Browser-based checker that scores a GitHub repository against 100 OWASP compliance points in 10 categories. | wich.owaspblt.org |
| BLT-Pages | Community-powered bug-reporting platform hosted from public/ on Cloudflare, part of the OWASP Bug Logging Tool (BLT) project. | pages.owaspblt.org |
| BLT-Panini | Static site that shows apps banned by countries around the world, as a searchable list and an interactive map. | panini.owaspblt.org |
| BLT-Pool | A GitHub App that integrates OWASP BLT services into GitHub repositories. | pool.owaspblt.org |
| BLT-Preflight | Advisory tool that gives contributors security guidance and risk notes before they open a pull request; it advises and never blocks. | preflight.owaspblt.org |
| BLT-Profiles | Git-native directory of profiles for security professionals, researchers, mentors, students and open-source contributors. | profiles.owaspblt.org |
| BLT-Rewards | BACON (Blockchain Assisted Contribution Network): Bitcoin Runes and Solana token rewards for open-source contributions. | rewards.owaspblt.org |
| BLT-SafeCloak | Privacy-focused peer-to-peer video and voice chat on Cloudflare Workers, with AI-assisted notes and explicit consent management. | safecloak.owaspblt.org |
| BLT-Sammich | Slack bot for the OWASP BLT community: GitHub activity, contributor stats, reminders and project discovery. | sammich.owaspblt.org |
| BLT-Sizzle | Async daily check-ins for organization teams: members post progress and blockers, admins see participation without another meeting. | sizzle.owaspblt.org |
| BLT-Start | A beautifully designed Contributor Start Page UI for the Bug Logging Tool (BLT) project. | start.owaspblt.org |
| BLT-Timer-Flutter | Linux desktop activity tracker in Flutter: counts keyboard and mouse activity through a native X11 library and shows live charts and daily summaries, keeping raw input private. | |
| BLT-Timer-Web | BLT Timer Web is a focused web application for recording manual work logs. | timer.owaspblt.org |
| BLT-Toasty | AI triage and responsible-disclosure assistant for BLT on Cloudflare Workers: redacts PII and secrets, detects duplicate reports and summarizes them. | toasty.owaspblt.org |
| BLT-Tomato | OWASP project management scripts and the funding site that lists OWASP projects seeking funding through a funding.yml file. | tomato.owaspblt.org |
| BLT-University | Open-source cybersecurity learning site: short courses, browser-based security labs and recent vulnerability data, with progress kept in the browser. | university.owaspblt.org |
| BLT-Vanish | An open-source, hybrid local+edge privacy toolkit for managing and deleting personal data online. | vanish.owaspblt.org |
| BLT-Vanish-Flutter | The local Flutter application for BLT-Vanish - handles all sensitive personal data locally and encrypted. | |
| BLT-Waypoint | Live dashboard of the OWASP BLT projects: commits, issues, pull requests and live site of every folder in this monorepo. | waypoint.owaspblt.org |
| BLT-Zero | Zero-Trust Vulnerability Reporting — encrypted payload delivery. | zero.owaspblt.org |
| coderabbit | Placeholder carried over from the old GitLab group: it holds only a license and has no code or configuration yet. | |
| dot_github | Organization profile README and the scripts that refresh its blog posts and contributor wall. | |
| MY-GSOC-TOOL | Dashboard for Google Summer of Code students that gathers their GitHub contributions, blog posts, mentor feedback and milestones on one page. | gsoc-tool.owaspblt.org |
Last updated: 2026-10-22 06:17 UTC — from dev.to/owaspblt
 When GitHub Went Dark: How OWASP BLT Found a New Home |  Eleven Projects, One Remarkable Team: Celebrating OWASP BLT’s GSoC 2026 |
Last updated: 2026-10-22 07:01 UTC — everyone with a commit in any BLT project, authors and co-authors, bots excluded (1 on git.owaspblt.org, 245 on GitHub, 29 by commit name only). Avatars and the full list live in .forkmesh/contributors.
Every Cloudflare project deploys from its own folder. Set CLOUDFLARE_API_TOKEN and CLOUDFLARE_ACCOUNT_ID, then:
scripts/deploy.sh blt-leaf # one project
scripts/deploy.sh blt-leaf blt-api # several
scripts/deploy.sh --all # everything
scripts/deploy.sh --all --dry-run # build and validate onlySecrets are set per Worker with wrangler secret put (see each project's README).
| Project | Folder | Deploy type | Cloudflare name | Crons |
|---|---|---|---|---|
| blt-action | blt-action/ |
worker | blt-action | |
| blt-api | blt-api/ |
worker | blt-api | |
| blt-autopatch | blt-autopatch/ |
worker | blt-autopatch | |
| blt-byte | blt-byte/ |
pywrangler | blt-byte | |
| blt-cli | blt-cli/ |
worker | blt-cli | |
| blt-cve | blt-cve/ |
worker | blt-cve | |
| blt-dash | blt-dash/ |
worker | blt-dash | |
| blt-design-contest | blt-design-contest/ |
worker | blt-contest | |
| blt-design | blt-design/ |
worker | blt-design | |
| blt-docs | blt-docs/ |
worker | blt-docs | |
| blt-enforcement | blt-enforcement/ |
worker | blt-enforcement | |
| blt-extension | blt-extension/ |
worker | blt-extension | |
| blt-flutter | blt-flutter/ |
worker | blt-flutter | |
| blt-gitcaster | blt-gitcaster/ |
worker | blt-gitcaster | |
| blt-gsoc | blt-gsoc/ |
worker | blt-gsoc | |
| blt-hackathons | blt-hackathons/ |
worker | blt-hackathons | |
| blt-hackerhouse | blt-hackerhouse/ |
pywrangler | hackerhouse | |
| blt-home | blt-home/ |
worker | blt-home | |
| blt-ideas | blt-ideas/ |
worker | blt-ideas | |
| blt-jobs | blt-jobs/ |
worker | blt-jobs | |
| blt-ketchup | blt-ketchup/ |
worker | blt-ketchup | |
| blt-leaf | blt-leaf/ |
worker | blt-leaf | |
| blt-lettuce | blt-lettuce/ |
worker | blt-lettuce | |
| blt-mayo | blt-mayo/ |
worker | blt-mayo | |
| blt-mcp | blt-mcp/ |
worker | blt-mcp | |
| blt-monitor | blt-monitor/ |
worker | blt-monitor | |
| blt-netguardian | blt-netguardian/ |
worker | blt-netguardian | |
| blt-newsletter | blt-newsletter/ |
worker | blt-newsletter | |
| blt-next | blt-next/ |
worker | blt-next | |
| blt-nexus | blt-nexus/ |
worker | blt-nexus | |
| blt-ossh | blt-ossh/ |
worker | blt-ossh | |
| blt-owasp-bumper | blt-owasp-bumper/ |
worker | blt-owasp-bumper | |
| blt-owasp-metadata | blt-owasp-metadata/ |
worker | blt-owasp-metadata | |
| blt-owasp-projects | blt-owasp-projects/ |
worker | blt-owasp-projects | |
| blt-owasp-wich | blt-owasp-wich/ |
worker | blt-owasp-wich | |
| blt-pages | blt-pages/ |
worker | blt-pages | |
| blt-panini | blt-panini/ |
worker | blt-panini | |
| blt-pool | blt-pool/ |
worker | blt-github-app | |
| blt-preflight | blt-preflight/ |
worker | blt-preflight | |
| blt-profiles | blt-profiles/ |
worker | blt-profiles | |
| blt-rewards | blt-rewards/ |
worker | blt-rewards | |
| blt-safecloak | blt-safecloak/ |
worker | blt-safecloak | |
| blt-sammich | blt-sammich/ |
worker | blt-sammich | |
| blt-sizzle | blt-sizzle/ |
script ./deploy.sh |
blt-sizzle | |
| blt-start | blt-start/ |
worker | blt-start | |
| blt-timer-web | blt-timer-web/ |
script ./deploy.sh |
blt-timer | |
| blt-toasty | blt-toasty/ |
worker | blt-toasty | |
| blt-tomato | blt-tomato/ |
worker | blt-tomato | |
| blt-university | blt-university/ |
worker | blt-university | |
| blt-waypoint | blt-waypoint/ |
worker | blt-waypoint | |
| blt-zero | blt-zero/ |
worker | blt-zero | |
| my-gsoc-tool | my-gsoc-tool/ |
worker | my-gsoc-tool | |
| blt-vanish | blt-vanish/cloudflare_workers/ |
worker | blt-vanish | |
| blt-cron | blt-cron/ |
worker | blt-cron | * * * * * |
CI, scheduled data refreshes, issue automation and deploys run as ForkMesh Actions from .forkmesh/; see docs/workflows.md for every workflow, its schedule and the secrets it needs.
There is no single licence for the whole repository: each project keeps its own LICENSE file in its folder, and
that file applies. Most projects are AGPL-3.0; blt-leaf is MIT and blt-lettuce is GPL-3.0, and a few folders have
no licence file yet. See the root LICENSE notice for the list.
The Projects and Contributors sections are generated by scripts/readme/update_readme.py.