Information Technology is educations need for helping in arranging and sharing the information. The Information should have integerity, therefore the security assessment is needed to conduct an assessment based on possible risk. Security Assessment uses VAPT method for assessing and testing a repository web aplication in XYZ Educational Institution. The assessment is done using Nessus tool. The result from the assessment process is a list of vulnerability in repository web aplication. Some of the vulnerability is used for penetration test to know the possible risk. This research is used as a report to stackholder institution, for evaluating proccess in their aplication web.