OPEN SOURCE · OFFLINE FIRST · APPSEC TO DEVSECOPS

Break it safely.
Fix it properly.

A local security workspace that connects hands-on OWASP practice with verification standards, threat modeling, secure delivery, and vulnerability decisions.

Open the app View on GitHub

30Web CTF challenges
10API mini-labs
500bilingual questions
50standards & methods
250public KEV records

ONE LOCAL WORKSPACE

From weakness to governed remediation

RØOT connects the technical loop of finding and fixing flaws with the senior-level work of defining requirements, modeling risk, prioritizing remediation, and protecting delivery.

01 · PRACTICE

Break and fix

Learn OWASP Web, API, and LLM risks through safe browser simulations, remediation, and quizzes.

02 · VERIFY

Prove controls

Use ASVS, WSTG, MASVS/MASTG, and LLMSVS to turn broad goals into testable evidence.

03 · ENGINEER

Model and govern

Connect Secure SDLC, SSDF, SAMM, NIST CSF, STRIDE, PASTA, LINDDUN, and abuse cases.

04 · OPERATE

Prioritize and ship

Combine CVSS, EPSS, SSVC, KEV, SLSA, SBOM, provenance, hardening, and platform controls.

OWASP WORKSPACE

Risks tell you where to look. Standards tell you what to prove.

Move from awareness lists to requirements, testing methods, maturity assessment, and platform-specific verification without leaving the local workspace.

ASVS 5.0Application requirements WSTG 4.2Web testing method OWASP SAMMAppSec maturity MASVS / MASTGMobile verification LLMSVS 2.0LLM verification

SENIOR APPSEC MAP

Different questions need different methods

Eleven practical domains connect secure delivery, authorized assessment, verification, remediation and response instead of presenting isolated framework definitions.

Secure SDLC

NIST SSDF · requirements · design review · security gates · GitOps

Threat Modeling

STRIDE · Attack Trees · Abuse Cases · PASTA · LINDDUN · ATT&CK

Offensive Assessment

PTES · NIST SP 800-115 · Kill Chain · adversary emulation · purple team

AppSec Testing

Code review · SAST · DAST · SCA · API testing · exploitability

Vulnerability Management

Triage · CVSS · EPSS · KEV · remediation · verified closure

Identity & API Security

Authorization · OAuth/OIDC · JWT · BOLA/BFLA · business abuse

Supply Chain

SBOM · SCA · SLSA · provenance · artifact signing

Cloud & Kubernetes

CIS · RBAC · workload hardening · network policy · secrets

Detection & Resilience

Telemetry · incident response · recovery · chaos · backup/DR

AI & Agentic Security

Prompt injection · tool boundaries · MCP · evals · MITRE ATLAS

Governance & Compliance

NIST CSF · control mapping · evidence · exceptions · risk ownership

BUILT FOR PRACTICE

No subscription. No cloud lab. No live target.

Run RØOT with Python or Docker, keep progress in your browser, and use it in disconnected classrooms, homelabs, or private AppSec environments.

OWASP Web, API, LLM, ASVS, WSTG, SAMM, MASVS and LLMSVS
Threat modeling and DevSecOps framework map
Payload library and attack-chain catalog
Command builders and report templates
Read-only SQLite CVE API

RØOT lab for A10 Server-Side Request Forgery with theory, practice, fix, and quiz tabs

THE WORKSPACE

One workspace for practice and security decisions

RØOT lifecycle map grouping security methods by stage — Enter by lifecycle stage — develop, model, assess, remediate, govern — and reach the method that answers your question.

RØOT OWASP workspace — Web, API and LLM risk lists sit next to ASVS, WSTG, SAMM, MASVS/MASTG and LLMSVS.

RØOT zero-day and CISA KEV catalog — Filter the bundled public CVE and KEV snapshot by severity, vendor, product, or identifier.

RØOT security tools catalog — 420 tool references with purpose, usage, example command and install source.

RØOT payload library, command builder and attack chains — Payload library, command builders and attack chains for authorized labs only.

RØOT quiz with explained answers — 500 questions with the correct answer and the reasoning behind it.

RUN LOCALLY

One command away

Python 3.10+ is enough. The bundled standards map and public CVE seed work without external credentials.

git clone https://github.com/madnessbrainsbl/ROOT.git
cd ROOT
python3 serve.py

docker compose up --build

RØOT v0.1.0

Practice the flaw. Verify the control. Govern the fix.

Start with a lab or open the lifecycle map to connect engineering work with AppSec program decisions.

Start with A01 Open the framework map Send feedback

Break it safely.Fix it properly.