OpenCTEM

Documentation for OpenCTEM: getting started, deployment, operations, architecture and integration guides. Published at docs.openctem.io.

Open-source Continuous Threat Exposure Management (CTEM) platform: asset discovery, attack surface management, risk-based prioritization, validation and remediation in one place. Go API + Next.js web UI.

Official Helm charts for deploying OpenCTEM on Kubernetes: API, web UI, sensors, migrations, with PVC or S3 attachment storage.

Self-host OpenCTEM on a hardened VM with Ansible: signed images, Cloudflare Tunnel, encrypted backups

OpenCTEM Sensor: lightweight scanner runtime that runs Nuclei, Trivy, Semgrep, Betterleaks and recon tools close to your assets and reports results to the OpenCTEM platform.

Go SDK for OpenCTEM: API client, sensor runtime kit and ready-made scanner integrations (Nuclei, Trivy, Semgrep, CodeQL, subfinder, httpx, naabu, katana) with an SSRF-safe HTTP layer.

OpenCTEM CI/CD runner: per-tool scanner images (SAST, SCA, secrets, IaC, container) and GitHub/GitLab integrations

OpenCTEM Tenable Security Center connector: keeps the Tenable.sc API keys in their own sensor

CTIS (CTEM Ingest Schema): the open specification, JSON Schemas and Go types for sending assets, findings and SBOM dependencies from security tools to a CTEM platform.

OpenCTEM SAST rules for opengrep: permissively licensed, tested, signed releases