Vulnotes gives pentest teams one place to write findings, review work and deliver polished reports through a clear, consistent workflow.
5 formats
PDF, DOCX, XLSX, JSON and ZIP
Your infrastructure
Cloud, self-hosted or air-gapped
Your workflow
API, webhooks and MCP included
One plan
No report limits
Write with AI
01Create findings from screenshots, improve technical writing and translate report content with context-aware AI. Sensitive details are anonymized before they reach an external provider, or you can use a local model.
Explore the AI assistantReview together
02Authors, reviewers and project leads work in one report. Comments, status changes and approvals stay attached to the work, so delivery does not depend on scattered messages and file versions.
See collaboration toolsDeliver consistently
03Design branded templates in the browser, preview the final document as you write and export to PDF, DOCX, XLSX, JSON or encrypted ZIP when the work is ready.
Discover template designThe report preview stays beside the finding. Writers can see how technical detail, severity and remediation will appear to the client before the document reaches review.
Managed by Vulnotes and ready to use.
Deploy on your own infrastructure.
Operate with zero network connectivity.
No report limits and no separate self-hosting tier. Give every member of your reporting team the same complete toolkit.
No. Self-hosting is included in every plan at the same price as cloud, with a one-command Docker install on your own infrastructure. Learn more about self-hosting.
Before data reaches an external provider, company names, IP addresses, domains, URLs, email addresses and person names are replaced with placeholders and restored in the response. You can bring your own model, run locally with Ollama or disable AI entirely. See how anonymization works.
Unlimited reports, five export formats, collaboration and review, SSO and 2FA, the REST API and MCP server, 1M Vulnotes AI tokens per user per month, and self-hosting. See the full pricing breakdown.
Yes. The Air-Gap Server edition runs on networks with zero connectivity, while the Air-Gap Workstation edition is a standalone application for macOS, Linux and Windows that runs on one isolated machine. Licensing and updates work fully offline. Learn about the air-gapped editions.
Yes. Design branded report layouts in your browser with LiquidJS variables, charts, custom fonts and linked translations, without editing document templates by hand. Explore the template builder.
Yes. The REST API, Python SDK, webhooks and MCP server let you automate report writing and exports from your own tools or any MCP client. Explore API and MCP automation.