Your scanners pass. Your audit evidence doesn't exist. We built the missing layer.

说明与用途

受监管团队使用开源 devsecops‑os 层生成签名的证据包，证明安全控制已运行且未发现漏洞。该包存储在仓库中，可供审计人员验证。

问题

Auditors need verifiable evidence that security controls ran on a specific commit, but teams spend weeks assembling screenshots from scanners.

结果

In a sample workload with four planted faults, the pipeline blocked at gates 1, 4, 5, and 8 exactly as expected; clean code passed all 10 gates. Evidence bundles covered 13 of 14 control‑mapping rows and were verified in‑job. Median CI run time was 58 s, with a golden path of 5 min 42 s.

工作流

• 1. Define policy pack v1 with 14 policies and evidence schemas mapping to ISO 27001, NIST CSF, PCI DSS, APRA CPS 234, SOC 2.
• 2. Add 10 CI gates as reusable GitHub Actions workflows that invoke shell scripts identical to local runs.
• 3. Run the pipeline on a commit; gates block on planted faults or allow clean code.
• 4. Evidence collector harvests run records, validates against schemas, writes SHA‑256 manifest, and creates a bundle.
• 5. Bundle is keyless‑signed with Cosign via OIDC and verified in‑job.
• 6. Auditors retrieve the bundle and verify signatures and hashes to confirm evidence integrity.

证据

The sample workload ships in two variants that differ in exactly 4 planted faults. Measured with pinned tool versions, locally and on GitHub Actions:

来源

The clean variant passes all 10 gates. Gate 3 (SCA) independently reports 9 CVEs in the planted dependency set, including the KEV one — detection and blocking are separate, deliberate layers.

来源

Each CI run's evidence bundle was keyless‑signed via Cosign/OIDC and the signature verified in‑job.

来源

The evidence bundle for a run covers 13 of 14 phase‑1 control‑mapping rows with real, schema‑checked records.

来源