RedScribe

Commercial use free for one year

Run the whole engagement,
not just the report.

RedScribe is self-hosted engagement, finding, checklist, and report management for penetration testing teams who keep their own data on their own infrastructure.

Read the docsView source

Source-available. Free forever for personal and noncommercial use.

One engagement moves through one tool. Create it, run your checklist, log findings against it, review and QA them, then generate the report your client actually reads, in the format they asked for.

What it actually runs

  • Engagements & findings

    An engagement moves through a real status lifecycle with membership and scope-change approval. Findings carry CVSS v3.1 and v4.0 scoring, move through a draft, review, and QA workflow, and can be raised by hand, pulled from a shared vulnerability catalogue, or imported straight from Nmap, Burp Suite, or Nuclei output.

  • Reporting

    One shared model drives every export, so Markdown, HTML, PDF, and Word all render the same report. Word export fills in a .docx template you design yourself, styled with your own document’s named styles, not a generic generated layout.

  • Client portal

    Client accounts log in to a deliberately narrow view: their own released engagements, and within them, only findings that have actually cleared QA. Nothing else is editable, nothing else is visible.

  • Security

    AES-256-GCM encryption per engagement, TOTP MFA required on every local account, and an append-only, hash-chained audit log covering every request, not only the ones that change something.

  • Administration

    Roles and permissions are fully dynamic, not fixed tiers. Backup and restore runs encrypted and server-side, with an account-change diff shown before anything live gets overwritten.

Commercial use is free right now.

RedScribe ships every feature on every instance, no exceptions. Personal and noncommercial use stays free permanently, under the PolyForm Noncommercial License. As a kickstart for the community, commercial use is free too, for up to a year: email redscribe.maintainer@proton.me for a commercial license key at no cost. Priced tiers arrive once RedScribe has been proven at the scale real enterprise engagements demand.

How licensing works

Four ways to run it

Docker Compose with automated Tailscale HTTPS, your own TLS certificate, plain HTTP on a trusted network, or local development without Docker at all.

docker compose --profile tailscale up -d --build
Installation guide