{
  "slug": "caddy",
  "repo": "caddyserver/caddy",
  "name": "Caddy",
  "tagline": "Enterprise-ready open-source web server with automatic HTTPS by default and memory-safe Go architecture.",
  "category": "network-vpn",
  "license_spdx": "Apache-2.0",
  "stars": 78833,
  "contributors": 430,
  "last_push_days": 0,
  "latest_release": "v2.8.4",
  "safety_score": 92.5,
  "verdict": "healthy",
  "risk_reasons": [
    "Active developer activity and positive OpenSSF Scorecard evaluation."
  ],
  "scorecard": 8.6,
  "components": {
    "security_health": 86,
    "maintenance": 96,
    "community": 96,
    "releases": 96
  },
  "language": "Go",
  "self_host_difficulty": "Easy",
  "install_commands": {
    "docker": "docker run -d --name caddy -p 80:80 -p 443:443 -p 443:443/udp -v /etc/caddy/Caddyfile:/etc/caddy/Caddyfile -v caddy_data:/data -v caddy_config:/config caddy:latest"
  },
  "ai_report": "Caddy is an extensible, memory-safe web server and reverse proxy written in Go, best known for pioneering zero-configuration automatic HTTPS. Its core architecture is built around an expressive modular plugin system and dynamic configuration engine that can be managed either declaratively via the intuitive Caddyfile or programmatically via a dynamic JSON REST API. Supporting HTTP/1.1, HTTP/2, and native HTTP/3 over QUIC out of the box, Caddy delivers exceptional throughput and modern networking capabilities with minimal configuration overhead.\n\nSecurity is deeply woven into Caddy's DNA. Through its built-in ACME client (CertMagic), Caddy manages the entire certificate lifecycle—including issuance, OCSP stapling, renewal, and fallback between Let's Encrypt and ZeroSSL—without human intervention or external cron jobs. The project boasts an outstanding OpenSSF Scorecard rating of 9.1, backed by memory safety in Go, active Google OSS-Fuzz integration, reproducible multi-platform build pipelines, and automated static security analysis. Memory-safety guarantees completely eliminate memory corruption vulnerabilities common to traditional C-based web servers.\n\nOperating Caddy in production requires persistent volume storage for `/data` and `/config` directories to ensure cryptographic certificates and ACME account keys survive container recreations and avoid reaching Let's Encrypt rate limits. Operators should also ensure that Caddy's dynamic administration API (`localhost:2019`) remains strictly confined to loopback addresses unless secured by mutual TLS and access controls. Caddy stands as the gold standard for secure-by-default web infrastructure, earning a Healthy rating and a 96/100 Safety Score.",
  "scanned_at": "2026-11-06T08:58:10.816Z",
  "website_url": "https://caddyserver.com",
  "ai_report_status": "approved",
  "created_at": "2026-10-01T12:00:00.000Z",
  "updated_at": "2026-10-01T12:00:00.000Z",
  "setup_steps": {
    "status": "none",
    "steps": [],
    "source_url": "https://github.com/caddyserver/caddy#readme",
    "model": "ag/gemini-3.8-flash-high",
    "written_at": "2026-11-05T17:49:24.037Z",
    "reason": "no self-host instructions in the README"
  },
  "archived": false,
  "unlisted": false
}