YAML templates make checks readable and repeatable
Nuclei separates the scanning engine from the detection logic. A template describes requests, matchers, extractors, metadata, and severity, while the Go CLI schedules that work across targets. Security engineers can inspect the exact condition behind a finding, keep a private template beside an application, and rerun it after a fix. The separate community template library supplies checks for published vulnerabilities, exposures, default credentials, and common configuration mistakes.
The protocol range is much wider than HTTP. Current flags cover DNS, TCP, SSL, WebSocket, WHOIS, headless browsing, JavaScript, file checks, workflows, and code templates. That breadth is useful for one scanner feeding several security jobs. It also means a template is active content. A reviewer should distinguish a request-only YAML check from one that launches a browser, reads a file, or invokes code on the scanning host.
The README describes zero false positives as a goal, not a result we measured. Multi-step matchers can reduce noisy guesses by checking the condition that proves a flaw, yet template quality and target behavior still decide the output. Treat each finding as a reproducible lead. Preserve the template ID, engine version, request evidence, and response evidence so another engineer can confirm it.
What happened when we ran it
Our sandbox cloned commit 84b464e with 3 CPUs, 8 GB of RAM, Go 1.24, and no secrets. Installation succeeded in 76 seconds and fetched 758 packages. The build succeeded in 269 seconds. Those numbers make the first source build a several-minute job even before a template library or target scan enters the picture.
Tests ran for 260 seconds and returned exit code 1. The Go parser counted 140 passes and 3 failures out of 143. The supplied tail shows a sequence of successful packages under template execution, types, utilities, and workflows, then a final FAIL. It does not name the failed cases or print their errors, so assigning a cause would be guesswork. The useful conclusion is limited: the complete command did not pass in our fresh Debian container.
The repository held 1,278 files, about 139,896 lines of source, and 18.3 MB of checked-out data. We found 13 CI workflow files and a Dockerfile, but no top-level tests directory. Go tests live beside packages, so that directory signal does not imply an absence of tests. The 143 recorded results show that the harness found and ran them.
Default concurrency needs an owner-approved target list
The CLI defaults shown in the README include 150 requests per second, 25 templates in parallel, 25 hosts per template, and 120 JavaScript runtimes. Those are configurable ceilings, not a safe policy for every network. A production service, fragile appliance, or third-party endpoint can react badly to a scan that is harmless in staging. Set scope, exclusions, timeouts, retries, and per-host limits before connecting Nuclei to asset inventory.
Authorization matters because fuzzing and active templates can change request paths, parameters, or protocol state. Keep written scope and use a dedicated egress identity. Authenticated scans add secret files, cookies, headers, or client certificates, all of which deserve the same handling as deployment credentials. JSONL, Markdown, database, and SARIF outputs can contain request and response material unless raw data is omitted or redacted.
CI use works best with a small profile tied to a known regression. Running the full community catalog on every commit increases time, network traffic, and triage. Pin the engine and template revisions, validate templates before execution, select IDs or tags, and fail the build only on findings your team has agreed are release blockers.
Code templates turn template trust into host trust
Nuclei exposes flags for signing templates, rejecting unsigned templates, and explicitly enabling code protocol checks. Those controls acknowledge that a code template can execute commands on the scanner. Open issue 7663 reports that v3.10.0 cached a verified result using modification time rather than a content hash, allowing changed unsigned code to inherit a prior verified state. The report remained open on August 27, 2026.
That issue does not prove every current scan is compromised. It does justify defensive choices: keep code templates disabled unless required, source templates from a controlled repository, review changes, isolate the scanner, and clear or protect caches between trust domains. The README also warns that running Nuclei as a service may create security risks. An HTTP wrapper around powerful scan flags needs authentication, tenant isolation, network controls, resource limits, and strict template selection.
SARIF users have a separate integration concern. Open issue 7313 says the generated file uploads to GitHub but fails rules in Microsoft's SARIF validator and displays limited information. Teams relying on code-scanning dashboards should validate a representative export before designing policy or reporting around it.
v3.11.1 is active, with breaking changes still expected
GitHub published v3.11.1 on August 8, 2026, and recorded the latest repository push on August 26. The release included parser and panic fixes, template verification work, JavaScript changes, and dependency updates. GitHub showed 105 open issues and pull requests combined; a separate issue search returned 61 open issues. Same-day pull requests covered cookies, JavaScript options, headless Chrome, worker cancellation, and code sandboxing.
The README still labels Nuclei active development and tells users to expect breaking changes. That is credible for a scanner whose protocols, template format, and integrations keep expanding. Pin versions in automation, read release notes, and test a known target set before upgrading. Nuclei is a strong engine for controlled, authorized checks. It becomes risky when broad scope, community templates, code execution, and unattended service access are all enabled together.