See the next vulnerability the day it drops
Early Light is DefectDojo’s free, open source detection engine.
A new detector ships for each emerging vulnerability within a day of it going public. It works with Community Edition today, and alongside Sensei (available with DefectDojo Pro) when you want the fix written for you.
// Detector log
Every detector, logged in the open
PHP2Shell and eMudhra were first. Every detector that follows lands in the public repo within a day of disclosure, where anyone can read it, run it, and improve it.
View the detectors on GitHubTwo vulnerabilities dropped on the same day. We patched in an hour.
When vulnerabilities in PHP2Shell and eMudhra went public on the same day, our team merged a fix right away. Early Light came out of that work, and from here each new emerging vulnerability gets its own detector within a day, in a public repo where anyone can read it, run it, and improve it.
Two vulnerabilities dropped on the same day. We patched in an hour.
When vulnerabilities in PHP2Shell and eMudhra went public on the same day, our team merged a fix right away. Early Light came out of that work, and those two detectors are its first.
From here, each new emerging vulnerability gets its own detector within a day, in a public repo where anyone can read it, run it, and improve it.
From disclosure to detection in a day
A vulnerability goes public
Disclosure starts the clock. Attackers don’t wait for the next vendor release cycle, so a detector shouldn’t either.
A detector ships
Within a day, a detector for that vulnerability lands in the Early Light repo on GitHub, open for anyone to read and run.
You find it in your stack
Run Early Light from the command line, as a container, or in CI with its GitHub Action. It writes SARIF you can import into Community Edition, next to the findings you already triage.
Sensei writes the fix
With Sensei, available with DefectDojo Pro, a fresh detection becomes a pull request that fixes it, without leaving DefectDojo.
From disclosure to detection in a day
- 01Stage
A vulnerability goes public
Disclosure starts the clock. Attackers don’t wait for the next vendor release cycle, so a detector shouldn’t either.
- 02Stage
A detector ships
Within a day, a detector for that vulnerability lands in the Early Light repo on GitHub, open for anyone to read and run.
- 03Stage
You find it in your stack
Run Early Light from the command line, as a container, or in CI with its GitHub Action. It writes SARIF you can import into Community Edition, next to the findings you already triage.
- 04Stage
Sensei writes the fix
With Sensei, available with DefectDojo Pro, a fresh detection becomes a pull request that fixes it, without leaving DefectDojo.
From disclosure to detection in a day
01 A vulnerability goes public
Disclosure starts the clock. Attackers don’t wait for the next vendor release cycle, so a detector shouldn’t either.
02 A detector ships
Within a day, a detector for that vulnerability lands in the Early Light repo on GitHub, open for anyone to read and run.
03 You find it in your stack
Run Early Light from the command line, as a container, or in CI with its GitHub Action. It writes SARIF you can import into Community Edition, next to the findings you already triage.
04 Sensei writes the fix
With Sensei, available with DefectDojo Pro, a fresh detection becomes a pull request that fixes it, without leaving DefectDojo.
Free with Community Edition. Ready for Sensei.
Free, open source, and yours to run
Early Light is free and open source, like Community Edition. Run it alongside the 360+ built-in parsers you already use and keep its findings with the rest of your work.
Detection on day one, with the fix to match
Pair Early Light with Sensei to go from a new detection to a pull request that fixes it. Early Light finds the exposure, and Sensei closes it.
Built in the open, with the community
Every detector is public. Tell us which vulnerability to cover next, report what breaks, and send pull requests. DefectDojo has been open source since 2014, and Early Light follows the same playbook.
Frequently asked questions
What is Early Light?
Early Light is DefectDojo’s free, open source detection engine. It ships a detector for each new emerging vulnerability within a day of it going public. The first two, eMudhra and PHP2Shell, were both disclosed and merged into Early Light on October 21, 2026.
Is Early Light free?
Yes. Early Light is free and open source under the BSD 3-Clause license, and the code lives on GitHub at DefectDojo/earlylight.
Does Early Light work with Community Edition?
Yes. Early Light writes its results as SARIF (as well as text and JSON), and you can import the SARIF file into Community Edition alongside the rest of your findings. The GitHub Action writes it to earlylight.sarif for you.
How does Early Light work with Sensei?
Sensei is available with DefectDojo Pro. Pair the two and a new detection can become a pull request that fixes it, without leaving DefectDojo.
How do I get started?
Install it with the one-line install script in the README, through Homebrew (brew install defectdojo/tap/earlylight), with go install, or as a container image at ghcr.io/defectdojo/earlylight. Run earlylight detectors to list the detectors, then point it at a filesystem, container image, source repo or live host. In CI, add the DefectDojo/earlylight GitHub Action.
Does Early Light send any data to DefectDojo?
No. Early Light runs entirely on your machine or CI runner, with no telemetry, no analytics and no account. It only connects to the network when a check needs it, such as pulling an image from its registry, and results stay wherever you put them.
How can I contribute?
Open an issue or a pull request on GitHub. The README explains how to add a new detector. You can also tell us which vulnerability to cover next in the DefectDojo Community Slack.