RedScribe documentation
How to install, configure, run, and extend RedScribe, the self-hosted engagement, finding, checklist, and report manager for penetration testing teams.
These docs cover RedScribe 0.7.0-alpha. RedScribe is alpha software; read Alpha status & versioning before relying on it for a real engagement, and the Changelog for what changed in each release.
Start here
Section titled “Start here”- Quickstart Try RedScribe locally in a few minutes, with no TLS and no domain.
- Installation The four supported ways to run it, from automated Tailscale HTTPS to bare metal.
- First run Generate the root encryption key and create the first Superadmin.
- Concepts & terminology Engagements, findings, roles, and the other terms these docs assume.
Guides by role
Section titled “Guides by role”- TestersFindings Write and score findings. See also Checklists and Scanner import.
- Reviewers and QAThe review workflow Draft → review → QA, comments, and who can review what.
- Team leadsEngagements Status lifecycle, membership, scope changes, and releasing to the client portal.
- AdministratorsRoles & permissions Built-in and custom roles, then users, report profiles, and the audit log.
Common tasks
Section titled “Common tasks”- Upgrade to a new release The upgrade procedure, version tags, and rolling back.
- Back up and restore Encrypted server-side backups and the restore safety checks.
- Add a user Create accounts and choose their role and sign-in method.
- Recover a locked-out account Lost password or lost MFA device, including the recovery command.
- Customise the report Report profiles: structure, appearance, labels, and text blocks.
- Use your own Word template Build a .docx template the Word export fills in.
- Set environment variables Every setting RedScribe reads, with its default.
- Troubleshoot an install Fixes for the problems people hit most often.
What RedScribe is
Section titled “What RedScribe is”RedScribe is a self-hosted web application for running penetration testing engagements: scoping, checklist-driven testing, writing and reviewing findings, and exporting the client report. One instance serves one consultancy, and all engagement data stays on the server you run it on, encrypted per engagement. See the Sample report for what an export looks like.
How it works
Section titled “How it works”A typical engagement starts with logging findings by hand, pulling them from the finding catalogue, or importing results straight from Nmap, Burp Suite, or Nuclei. Each finding then moves through a real draft, review, and QA workflow, so nothing reaches a client before someone has actually checked it.
Once the engagement wraps, that same data becomes the client report, exported as Markdown, HTML, PDF, or Word from one shared source, so nothing drifts between formats. Throughout, findings stay on the server you run, encrypted per engagement with AES-256-GCM and keyed off a single instance root key.
What RedScribe is not
Section titled “What RedScribe is not”- Not multi-tenant SaaS. One instance serves one consultancy, and client companies get a restricted read only portal rather than their own tenant.
- Not yet 1.0. RedScribe is early alpha. See Alpha status & versioning before relying on it for a real engagement.
- Not a vulnerability scanner. It imports results from Nmap, Burp Suite, and Nuclei, but it doesn’t run scans itself.
RedScribe is source-available; see Licensing for what the license means day to day.
Getting help
Section titled “Getting help”- Something not working? Start with Troubleshooting.
- Found a bug or a gap in these docs? Open an issue.
- Found a security vulnerability? Report it privately, as described in the security policy.