Pour voir la démonstration complète en vidéo, consultez la section "Support & Contact" ci-dessous.
OpenRisk is a modern, enterprise-grade Risk Management Platform that transforms how organizations identify, assess, mitigate, and monitor risks. Built with a scalable microservices architecture, OpenRisk enables teams to move beyond spreadsheets and legacy systems into a seamless, automated risk management experience.
OpenRisk allows every organization to:
- ✅ Identify IT & security risks
- ✅ Score & Prioritize risks based on impact and probability
- ✅ Track mitigation plans and action items
- ✅ Monitor trends in real-time with interactive dashboards
- CTO & CISO - Strategic risk oversight and compliance
- DevSecOps - Integrated security in CI/CD pipelines
- Security Analysts - Risk assessment and investigation
- Compliance Teams - Audit trails and governance
- ⚡ Automated Risk Assessment - Reduce manual evaluation time
- 📊 Interactive Dashboards - Real-time risk visualization
- 🔌 Native Integrations - Elastic, Splunk, TheHive, OpenCTI, AWS
- 🐳 Easy Deployment - Docker & Kubernetes ready
- 🔐 Enterprise Security - RBAC, SSO, audit logging
- 📈 Scalable Architecture - Microservices-ready
- 🎲 Risk Assessment - Comprehensive risk identification and scoring
- 🛡️ Mitigation Tracking - Monitor and track risk mitigations in real-time
- 📊 Advanced Analytics - Real-time dashboards and trend analysis
- 🔐 Enterprise Security - RBAC, audit logging, OAuth2/SAML2 SSO
- 🔌 Integration Ready - TheHive, OpenCTI, Splunk, Elastic connectors
- ⚙️ Custom Fields - Flexible schema for organizational needs
- 📈 Gamification - Engagement and incentive system
- Docker & Docker Compose
- Git
- 4GB RAM, 2GB disk space
# Clone the repository
git clone https://github.com/opendefender/OpenRisk.git
cd OpenRisk
# Create .env file with secure credentials
cat > .env.local << 'EOF'# Admin Account (customize these values)INITIAL_ADMIN_EMAIL=admin@yourdomain.comINITIAL_ADMIN_PASSWORD=<YOUR_SECURE_PASSWORD_HERE># JWT ConfigurationJWT_SECRET=<YOUR_JWT_SECRET_HERE>JWT_EXPIRATION_HOURS=24# DatabaseDATABASE_URL=postgresql://openrisk:secure_password@postgres:5432/openriskREDIS_URL=redis://redis:6379# APIAPI_PORT=8080API_HOST=0.0.0.0EOF# Start all services (PostgreSQL, Redis, Backend, Frontend)
docker compose up -d
# Access the application# Frontend: http://localhost:5173# Backend API: http://localhost:8080# API Docs: http://localhost:8080/swagger# Login with credentials from .env.localNEVER use default/hardcoded credentials in production!
- Always create strong, unique passwords
- Use environment variables (
.envfiles) - never commit them to Git - Add
.env.localto your.gitignore - Rotate credentials regularly in production
- Use a secrets management solution (Vault, AWS Secrets Manager, etc.)
Password Requirements (enforced server-side at registration):
- Minimum 12 characters
- At least three of: lowercase, uppercase, digits, symbols
- Common and predictable passwords are rejected
- Preferably generated with a password manager (1Password, Bitwarden, etc.)
| Component | Technology | Version |
|---|---|---|
| Language | Go | 1.25.4 |
| Framework | Fiber | v2.52 |
| Database | PostgreSQL | 16 |
| ORM | GORM | v1.31 |
| Testing | Testify | v1.11 |
| Architecture | CLEAN | Domain-Driven |
| Component | Technology | Version |
|---|---|---|
| Framework | React | 19.2.0 |
| State | Zustand | 5.0.8 |
| Styling | Tailwind CSS | 3.4.0 |
| Forms | React Hook Form | 7.66 |
| Routing | React Router | 7.9.6 |
| Charts | Recharts | 3.5.0 |
| Component | Technology | Purpose |
|---|---|---|
| Containerization | Docker | Application packaging |
| Orchestration | Kubernetes | Production deployment |
| Charts | Helm | K8s configuration |
| CI/CD | GitHub Actions | Automated testing & deployment |
| Caching | Redis | Session & cache layer |
- ✅ Risk CRUD operations (Create, Read, Update, Delete, List)
- ✅ Risk scoring engine with weighted calculations
- ✅ Mitigation tracking with checklist sub-actions
- ✅ Asset management and relationships
- ✅ Soft-delete support with audit trails
- ✅ JWT-based authentication
- ✅ API Token management (create, revoke, rotate)
- ✅ Role-Based Access Control (RBAC) - Backend (37+ endpoints, 11 domain models)
- ✅ Permission matrices (resource-level granularity)
- ✅ Comprehensive audit logging
- ✅ OAuth2/SAML2 SSO (Google, GitHub, Azure AD)
- ✅ Docker Compose local development
- ✅ GitHub Actions CI/CD pipeline
- ✅ Integration test suite
- ✅ Kubernetes Helm charts
- ✅ Staging & production runbooks
- ✅ Permission gate components (7 reusable wrappers)
- ✅ Route-level permission guards (4 types)
- ✅ Role & Tenant management pages (admin interfaces)
- ✅ Advanced RBAC utilities (35+ functions)
- ✅ Audit logging system (compliance tracking)
- ✅ Permission caching (performance optimization)
- ✅ Custom React hooks (usePermissions, useAuditLog)
- ✅ Comprehensive documentation (2,000+ lines)
- ✅ Custom fields framework (5 types)
- ✅ Bulk operations with validation
- ✅ Risk timeline (audit trail)
- ✅ Advanced reporting & export
- ✅ SSO integration (OAuth2/SAML2)
Performance Optimization:
- ✅ Redis caching layer (generic CacheService, TTL management)
- ✅ Query optimization (7 GORM patterns, N+1 elimination)
- ✅ Database indexing (70+ strategic indexes, 100x+ faster)
- ✅ Load testing framework (k6 baseline, 50+ concurrent users)
Testing & Validation:
- ✅ Integration tests (8 test cases, 312 lines, CRUD + concurrency)
- ✅ E2E tests with Playwright (12+ scenarios, 5 browsers/viewports)
- ✅ Security testing (11 categories, SQL injection/XSS/CSRF/auth)
- ✅ Performance benchmarks (9 benchmarks, all targets met)
- ✅ Docker Compose testing infrastructure (9 services, isolated env)
- ✅ Comprehensive testing guide (529 lines, CI/CD examples)
Performance Targets Met:
- Risk creation > 100 ops/sec ✅
- Risk retrieval > 500 ops/sec ✅
- Cache operations > 1000 ops/sec ✅
- Dashboard load < 3 seconds ✅
- Risk list (100 items) < 5 seconds ✅
- 🚀 Analytics dashboard with real-time data
- 🚀 Risk heatmaps and trend analysis
- 🚀 Incident management system
- 🚀 Threat tracking and mapping
- 🚀 Gamification & engagement system
- 🚀 Performance monitoring & alerting
| Document | Purpose |
|---|---|
| TESTING_GUIDE.md | Complete testing procedures & execution guide |
| TESTING_COMPLETION_SUMMARY.md | Phase 5 testing overview & metrics |
| OPTIMIZATION_REPORT.md | Performance optimization strategies & analysis |
| PERFORMANCE_TESTING.md | k6 load testing configuration & guide |
| LOCAL_DEVELOPMENT.md | Setup guide for development environment |
| API_REFERENCE.md | Complete API endpoint documentation |
| KUBERNETES_DEPLOYMENT.md | K8s deployment instructions |
| PRODUCTION_RUNBOOK.md | Production operations guide |
| SAML_OAUTH2_INTEGRATION.md | SSO integration guide |
| ADVANCED_PERMISSIONS.md | RBAC & permissions documentation |
For more documentation, see the docs directory.
docker compose up -d# See docs/STAGING_DEPLOYMENT.md
./scripts/deploy-kubernetes.sh --environment staging# See docs/PRODUCTION_RUNBOOK.md
helm install openrisk ./helm/openrisk \
-f helm/values-prod.yaml \
--namespace openriskIntegration Tests - Database-level testing with PostgreSQL & Redis
go test -v ./tests/integration_test.go -timeout 30m- 8 test cases covering CRUD, relationships, concurrency
- Query performance validation
- Audit logging verification
E2E Tests - User workflows in real browsers with Playwright
npx playwright test [--headed] [--project=chromium|firefox|webkit]
npx playwright show-report- 12+ test scenarios across 5 browsers/viewports
- Authentication, risk management, custom fields
- Mobile responsiveness (iPhone 12, Pixel 5)
- Performance metrics validation
Security Tests - Vulnerability scanning and protection verification
go test -v ./tests/security_test.go -timeout 30m- CSRF protection, SQL injection prevention
- XSS protection, rate limiting, auth bypass detection
- Security headers validation, CORS verification
Performance Benchmarks - Throughput and latency measurements
go test -v -bench=. ./tests/performance_benchmark_test.go -timeout 30m- 9 benchmarks covering all critical operations
- Cache vs database performance comparison
- Concurrent operation handling
Docker Compose Testing - Isolated test environment
docker-compose -f docker-compose.test.yaml up -d
docker-compose -f docker-compose.test.yaml run integration_tests
docker-compose -f docker-compose.test.yaml run security_tests
docker-compose -f docker-compose.test.yaml run performance_tests
docker-compose -f docker-compose.test.yaml run e2e_tests
docker-compose -f docker-compose.test.yaml down -v- 30+ test cases across all test suites
- 2,707 lines of test code
- 11 security categories (OWASP coverage)
- 9 performance benchmarks (all targets met)
- 5 browser/viewport combinations
See TESTING_GUIDE.md and TESTING_COMPLETION_SUMMARY.md for detailed testing documentation.
OpenRisk provides a comprehensive REST API with 37+ endpoints:
POST /api/risks - Create risk
GET /api/risks - List risks
GET /api/risks/:id - Get risk details
PATCH /api/risks/:id - Update risk
DELETE /api/risks/:id - Delete risk
POST /api/mitigations - Create mitigation
GET /api/mitigations - List mitigations
PATCH /api/mitigations/:id - Update mitigation
POST /api/mitigations/:id/sub-actions - Add checklist item
PATCH /api/mitigations/:id/sub-actions/:aid - Toggle completion
POST /auth/login - JWT authentication
POST /auth/register - User registration
POST /auth/oauth2/:provider - OAuth2 login
POST /auth/saml/acs - SAML assertion endpoint
GET /api/tokens - List API tokens
POST /api/tokens - Create new token
DELETE /api/tokens/:id - Revoke token
GET /rbac/roles - List roles
POST /rbac/roles - Create role
PUT /rbac/roles/:id - Update role
DELETE /rbac/roles/:id - Delete role
GET /rbac/permissions - List permissions
GET /rbac/tenants - List tenants
POST /rbac/tenants - Create tenant
GET /rbac/tenants/:id/stats - Tenant statistics
DELETE /rbac/tenants/:id - Delete tenant
GET /api/analytics/dashboard - Dashboard metrics
GET /api/analytics/trends - Risk trends
GET /api/reports - List reports
POST /api/reports/export - Export risks/mitigations
See API_REFERENCE.md for complete endpoint documentation with examples.
OpenRisk implements enterprise-grade security:
- Authentication: JWT tokens (RS256) with expiration and JTI blacklist
- Authorization: RBAC with permission matrices and resource-level granularity
- Password Hashing: Argon2id (m=64MB, t=3, p=4) - never SHA256 or bcrypt alone
- Encryption: AES-256-GCM for sensitive data at rest
- Audit Trail: Complete audit logging for all operations (append-only)
- SSO: OAuth2 (Google, GitHub) and SAML2 support
- Rate Limiting: Per-IP and per-tenant quotas across the API, with a stricter throttle on credential endpoints
- Security Headers: CSP, HSTS, X-Frame-Options, Referrer-Policy and nosniff
- Input Validation: Server-side request validation (go-playground/validator); Zod on the frontend
- Default Credentials: Never hardcoded - always use environment variables
- Secrets Management: Support for external secret managers (Vault, AWS Secrets Manager)
- Rotate credentials and API keys regularly
- Use strong passwords (12+ characters, mixed case, numbers, symbols)
- Enable MFA/2FA for all user accounts
- Keep dependencies updated regularly
- Run security scans (TruffleHog, Snyk, Trivy)
- Monitor audit logs for suspicious activity
See ADVANCED_PERMISSIONS.md and SECURITY.md for detailed security documentation.
OpenRisk includes keyboard shortcuts to help you work faster. Below is a complete list of available shortcuts:
| Shortcut | Action | Context |
|---|---|---|
| ⌘K or Ctrl+K | Open global search | Anywhere in the app |
| ⌘N or Ctrl+N | Create new risk | Dashboard and Risks page |
| Esc | Close modal/dialog | Any open modal or dialog |
| Shortcut | Action | Context |
|---|---|---|
| ↑ | Previous search result | In search suggestions |
| ↓ | Next search result | In search suggestions |
| Enter | Select search result | Search suggestions open |
| Esc | Close search dropdown | Search suggestions open |
| Shortcut | Action | Context |
|---|---|---|
| Esc | Close risk details | Risk details panel open |
| Esc | Close edit modal | Risk editing modal open |
- Search Tip: Use ⌘K / Ctrl+K from anywhere to quickly search for risks, assets, or mitigations
- Quick Create: Press ⌘N / Ctrl+N on the dashboard to rapidly create new risks
- Navigation: Use arrow keys in search results to navigate without your mouse
- Mobile: These shortcuts work best on desktop/laptop keyboards
- Edit Last Risk - ⌘E / Ctrl+E
- Filter Results - ⌘F / Ctrl+F
- Delete Selected - ⌘D / Ctrl+D
- Focus Search - / key
- Settings - ⌘, / Ctrl+,
We welcome contributions from the community! Please see CONTRIBUTING.md for guidelines.
- Fork the repository
- Create a feature branch (
git checkout -b feature/AmazingFeature) - Commit your changes (
git commit -m 'Add AmazingFeature') - Push to the branch (
git push origin feature/AmazingFeature) - Open a Pull Request
OpenRisk is open-core:
- Community Edition (the core GRC platform) — GNU AGPL v3.0 (
LICENSE). Free to self-host, study, modify and redistribute. The AGPL's network clause means anyone running a modified core as a hosted service must publish their changes under the AGPL. - Enterprise Edition (advanced SSO, AI copilot, premium connectors & SOAR,
multi-organisation management) — OpenRisk Commercial License
(
LICENSE.commercial), used under a paid subscription. - The design system (
frontend/design-system/andfrontend/src/shared/ds/) — Apache License 2.0 (frontend/design-system/LICENSE). Deliberately permissive: the tokens and primitives are meant to be copied and extended, including by commercial code. Attribution lives inNOTICE. Apache-2.0 grants no trademark rights — the OpenRisk and OpenDefender names and logos are not licensed by it.
Every source file declares its edition via its SPDX-License-Identifier header
(AGPL-3.0-only, LicenseRef-OpenRisk-Commercial or Apache-2.0). The
authoritative boundary between the three is LICENSING.md.
For commercial licensing: licensing@opendefender.io
- GitHub Issues: Report bugs or request features
- Discussions: Join community discussions
- Security: See SECURITY.md for security vulnerability reporting
Phase 6C Pre-Launch Audit (March 10, 2026) - Complete project assessment before SaaS deployment:
📊 COMPREHENSIVE_AUDIT_REPORT.md - Executive summary with 8 analysis dimensions:
- Performance Analysis (Score: 8/10)
- Architecture & Design Patterns (Score: 9/10)
- Security Audit (Score: 9/10)
- Code Quality Assessment (Score: 8/10)
- Documentation Review (50+ files)
- Testing Coverage (28 test files, ~40%)
- Dependency Analysis (50+ total dependencies)
- Zero AI/ML patterns detected ✅
🎯 RISK_REGISTER_FEATURES_ANALYSIS.md - Core feature verification:
- ✅ 13/13 Risk Register features confirmed present
- ✅ All 4 visualization types implemented
- ✅ Custom fields & templates working
- ✅ Bulk operations (UPDATE, DELETE, ASSIGN, EXPORT)
- ✅ Audit trail & timeline tracking
- ✅ Search, filtering & sorting
- Status: 95% COMPLETE & PRODUCTION READY
🔍 ANALYSIS_INDEX.md - Navigation hub for all audit documents with quick metrics
✅ COMPLETION_SUMMARY.md - Final verdict & next steps
- Implementation: Complete typeahead hook with fuzzy matching algorithm
- Features:
- Keyboard shortcuts (Cmd+K, Cmd+/, ↑↓, Enter, Esc)
- Fuzzy match scoring (0-1 relevance ranking)
- Recent searches (localStorage-backed)
- Command palette with global actions
- Status: ✅ Production-ready
- Documentation: ADVANCED_TYPEAHEAD_IMPLEMENTATION.md
- ✅ Redis caching layer implementation
- ✅ Query optimization (N+1 elimination)
- ✅ Database indexing (70+ indexes)
- ✅ Integration test suite (8 tests)
- ✅ E2E tests with Playwright (12+ scenarios)
- ✅ Security testing suite (11 categories)
- ✅ Performance benchmarking (9 benchmarks)
- ✅ Docker Compose testing infrastructure
- ✅ Comprehensive testing documentation
- ✅ All performance targets met (100-1000 ops/sec)
- 🚀 Real-time analytics dashboard
- 🚀 Risk trend analysis
- 🚀 Incident management
- 🚀 Performance monitoring & alerting
- 🚀 Gamification system
- Advanced RBAC enhancements
- Additional connector integrations
- Machine learning risk predictions
- API webhook support
- Enterprise audit compliance
- Custom dashboard builder
- Workflow automation
- Multi-tenant advanced features
OpenRisk is developed and maintained by the OpenDefender community.
- 📖 Check the documentation
- 🐛 Search existing issues
- 💬 Ask in discussions
Made with ❤️ by OpenDefender Community