License
Dual-licensed, open by default
The runtime is AGPLv3 for community use, with a paid commercial license when the copyleft obligations do not fit. The solution corpus is Apache 2.0.
Exploitmatic is dual-licensed: a free, open-source license (AGPLv3) and a paid commercial license. See the license file in the repository for the full terms.
| Free (AGPLv3) | Commercial | |
|---|---|---|
| Cost | Free | Paid |
| Source release for hosted services | Required by the AGPL network clause | Not required |
| Closed-source use | Not allowed for modified distributions | Allowed |
| Hosted-service attribution | Must show a Powered by Exploitmatic notice | Not required |
| Support | Community | Included |
| Best for | Individuals, open-source projects, authorized testing | Products, closed-source embedding, hosted platforms |
Attribution term
Under AGPLv3 section 7, if you offer Exploitmatic to third parties as a hosted service under the AGPL, you must display a clear and prominent Powered by Exploitmatic notice in the service's user interface, and you may not remove, obscure, or modify it. This does not apply under a commercial license.
Commercial license
If the AGPLv3 obligations do not fit your use, a commercial license replaces them with permissive, business-friendly terms and includes support. For commercial talks, email contact@exploitmatic.com or reach the maintainers through the repository.
The solution corpus
The attack solutions, the .txt files in the solutions repository, are Apache 2.0 under their own license. Recipes are data, not code, so the permissive license encourages sharing.
Write attacks down. Verify them.
Download the binary, point it at a target you own, and get a verified result. The corpus is open and the format is plain text.