OWASP/NodeGoat

Executive Summary: OWASP NodeGoat

What This Software Does
NodeGoat is an intentionally vulnerable web application created by OWASP (a respected web security organisation) as a training tool. It is designed to teach developers how to identify and fix the top 10 most common web security risks in Node.js applications. It is not a production business application — its purpose is education and security training.

Overall Health
Because this is a deliberately insecure teaching tool, its health metrics must be understood in that context. That said, the codebase is relatively small (~13,000 lines), and many of the vulnerabilities present are intentional features of the training environment. The dependency list is significantly outdated, with 422 packages, many of which are old and unmaintained. The "Slop Index" score of 100/100 (worst possible) indicates the code is not following modern best practices, which again aligns with its educational purpose.

Most Important Risks
The most serious concern is that this application should never be deployed on a public-facing server or used in a production environment. It contains 12 critical and 45 high-severity security vulnerabilities across its third-party components — including weaknesses in core libraries that handle file processing, data parsing, and user input. If accidentally deployed in a real environment, it would be trivially easy for an attacker to compromise. The outdated dependencies (some dating back to 2015–2018) compound this risk considerably.

Top Recommended Actions
1. Enforce strict deployment controls — Ensure this application is only ever run in isolated, local, or sandboxed training environments, never on shared infrastructure or the public internet.
2. Update the dependency inventory — Even for a training tool, refreshing the 422 dependencies would reduce noise and ensure the intentional vulnerabilities remain the focus, rather than accidental ones introduced by outdated packages.
3. Add clear governance labels — Attach prominent documentation to the repository and any internal deployments explicitly stating this is a training tool, so it cannot be mistakenly treated as a deployable product.