Not a vendor committee. Not a private equity playbook.
DefectDojo came out of the OWASP community and never left it.
The people who build it are the people who run it in production. Every parser, every integration, contributed and maintained in the open.
A Slack where people actually answer.
The maintainers are in there. So are the people running Dojo across 10,000 organizations. Ask a real question, get a real answer.
Shipped in the Open
Every version ships its release notes in public, and the announcements that matter land right beside them. Expand a row for the detail.
ReleaseSep 22, 2026
DefectDojo v3.3.100
A compliance-heavy release: PCI DSS, FDA, and EU regulatory packs, Sensei DAST scanning and AI Agent Red Teaming, and a new Command Center home page.
DefectDojo v3.3.100
- Compliance packs for PCI DSS, FDA cyber devices, and EU regulations
- Sensei Dynamic Scanning (DAST) launches Nuclei scans against verified targets
- AI Agent Red Teaming joins Sensei
- Command Center dashboard is now every user's home page
- Rules Engine 2.0 renamed Triage Engine
ReleaseSep 9, 2026
DefectDojo 3.3.0
A major platform release: cross-domain root-cause correlation, native PSIRT 2.0, a rebuilt asset model, and the classic UI retired in favor of the Pro Vue UI.
DefectDojo 3.3.0
- Cross-domain correlation groups findings into shared root causes
- PSIRT 2.0 folded natively into DefectDojo Pro
- Rebuilt asset model with versions, aliases, and typed relationships
- API v3 (alpha) debuts at /api/v3-alpha/
- Classic Bootstrap UI retired; Pro Vue UI is now standard
BlogSep 7, 2026
Getting Started with DefectDojo in 10 Minutes or Less
A hands-on tutorial that takes you from an empty instance to prioritized, assigned findings in ten minutes, minute by minute.
Getting Started with DefectDojo in 10 Minutes or Less
- Model your program with Organizations, Assets, Engagements, and Tests
- Import results from any of 500+ supported security tools
- Auto-enriched Priority, Severity, and Risk show what to fix first
- Push findings to Jira or GitHub Issues with auto-close
- SLAs, notifications, and reporting round out the first ten minutes
AnnouncementAug 27, 2026
DefectDojo Sensei Now Fixes Your Cloud Too: CSPM for AWS, Azure, and GCP
Sensei CSPM onboards AWS, Azure, and GCP accounts, scans them for misconfigurations, and fixes them by IaC pull request or a reversible Fix in Cloud.
DefectDojo Sensei Now Fixes Your Cloud Too: CSPM for AWS, Azure, and GCP
- Bulk-onboard cloud accounts with one read-only credential
- Posture findings land deduplicated and prioritized like any scan
- Fix in Cloud applies live changes through the provider API
- Every direct fix is human-approved, logged, and revertible
- Launch catalog covers public buckets, open security groups, and more
ReleaseAug 18, 2026
DefectDojo 3.2.201
A docs-heavy patch: questionnaire editing aligned, reporting Chart blocks documented, and faster CI for docs-only changes.
DefectDojo 3.2.201
- Questionnaire question-set editing aligned with question editing
- Chart blocks in reporting documented, no longer coming soon
- In-product docs link repaired after the sidebar page rename
- CI skips the heavy unit-test suite for docs-only pull requests
ReleaseAug 10, 2026
DefectDojo 3.2.100
Django steps up to 5.2.16, note visibility is enforced consistently, and the messaging connectors get real documentation.
DefectDojo 3.2.100
- Django updated to 5.2.16
- Note visibility filtering now covers paginated lists, not just querysets
- Slack, Microsoft Teams, and Email messaging connectors documented
Learn Dojo from the people who built it.
Recorded webinars, 101-level training and working sessions. Start with Community Edition and scale when you need to.
Beyond the Hype: Using DefectDojo's MCP for 10X AI LLM Performance for Vulnerability Management
August Office Hours: Staying Compliant with the Cyber Resilience Act
My Anthropic Bill Made Me Do It
Why a security company hardened Kimi's coding CLI, and why we're giving the fork away.
Frequently asked questions
Is DefectDojo Community Edition really free?
Yes. Community Edition is free forever under an OSI license, with 500+ parsers, deduplication, and the full source. You host it yourself.
Where does the community live?
DefectDojo came out of the OWASP community. Day to day, the community lives in the DefectDojo Slack and on GitHub, where the roadmap, issues, and releases are public.
How do I contribute?
Open an issue or a pull request on GitHub. Parser contributions are the most common starting point: if your scanner is not supported yet, the parser framework is built for exactly that.
What is the difference between Community Edition and Pro?
Community Edition covers aggregation, deduplication, and the core workflow. DefectDojo Pro adds Priority and Risk auto-triage, Sensei AI scan and fix, MCP support, and dedicated support.