#compliance

Plumber detects CI/CD security issues in your GitHub workflows and gives you a score

Open-source GRC toolkit from the GRC Engineering Club. Claude Code plugins for evidence collection, SCF crosswalks, multi-framework gap reports, OSCAL workflows.

Offline PII firewall for AI agents and LLM apps: fast local detection and redaction, Claude Code hook, LiteLLM guardrail. Zero network calls, one dependency.

JMo Security Suite - Terminal-first security audit toolkit with many tools, multi-target scanning, & compliance

Event sourcing made easy—no complexity, just powerful tools and flexibility for everyone, from beginners to pros.

A scalable server implementation of the OSS Review Toolkit.

Enterprise-ready SIEM, SOAR and Compliance powered by real-time correlation and threat intelligence.

Accountable Autonomy: open-source evidence layer that gates every AI agent tool call against your policy and writes a hash-chained record an auditor verifies offline, without trusting you. Root-agnostic; binds to TPM 2.0 / SEV-SNP when present. Your environment, no SaaS, no telemetry. AGPL-3.0.

Open source CSPM for Azure - scan for misconfigurations and quantum-unsafe cryptography, map findings to CIS/NIST/ISO27001/SOC2, and fix them with one command

OWASP dep-scan is a next-generation security and risk audit tool based on known vulnerabilities, advisories, and license limitations for project dependencies. Both local repositories and container images are supported as the input, and the tool is ideal for integration.

Audit logging, exports, alerts, and dashboards for Filament admin panels.

Openlane go-client, useful for automating your SOC 2 evidence collection, updating ISO27001 controls, or really anything you want to do in the Openlane system

Open-source AI Bill of Materials (AIBOM) scanner: inventories AI models, datasets, prompts, embeddings, vector DBs & RAG pipelines across code, containers & Kubernetes — with file:line evidence, load-time risk detection (poisoned pickle / Keras Lambda / unsafe torch.load) and NIST AI RMF / OWASP compliance mapping. CycloneDX · SARIF · JSON.

Heimdall Data Format (HDF) is a standardized JSON schema for representing security assessment baselines and results across diverse tools and platforms.