C

Compliance

A suite of tools to assist with reviewing Open Source Software dependencies. (Mirrored from https://github.com/oss-review-toolkit/ort)

Bedrock RMF — self-hosted NIST 800-53 Rev 5 / RMF compliance management (an eMASS / Xacta alternative): control implementations to the CCI, POA&Ms, evidence, HW/SW inventory, PPSM, STIG checklists, cloud inheritance. AGPL-3.0.

The landing page and the ten scenarios. The thesis, the claims ledger, and the public posture mirror an assessor can check without an account.

Chapter 6: a CI component at enforce phase. The off-catalog include is planted, and the red pipeline is the point: watch the gate stop it.

Compliance service enforcing rules defined in the TrustFramework - Architecture Document/Compliance Document

A Python-based CLI tool designed to scan GitLab projects for compliance against the CIS GitLab Benchmark. Check out the recommendations-as-code in this repo. Read the docs for more info.

The conformance contract for projects under gitlab-com/public-sector.

AI-powered GitLab CI Component that automates DISA ASD STIG compliance analysis reducing manual checklist completion from weeks or months to minutes using GitLab Duo agentic workflows to determine compliance with the 286 security controls.

Maintenance, asset, and configuration-change records for accredited systems. Single static binary, pure-Go SQLite, LDAP/AD auth with local break-glass accounts, hash-chained audit trail. AGPL-3.0-or-later.

Chapter 4: a Go binary at report phase. Gaps are published and advisory, so the merge request stays green while the finding rides along.

Chapter 3: the driver. One tool provisions the group, assesses each control, pushes verdicts, and exports OSCAL.

Chapter 5: a container image at cutover phase. The unsigned-image gap is planted, and the red pipeline is the point: watch the floor block it.

Source of truth for the Compliance engine, validating certificate are conforming to rules, providing shapes, schemas and trusted sources

CLI tool for GitLab automation: sync groups to local filesystem and audit projects against security & OpenSSF best practices with automated scoring

SharedRail is an open-source, federated payment infrastructure designed to enable secure, instant, and identity-based value transfer across currencies and borders. Built on a modular architecture with mandatory encryption, KYC, and AI-assisted human intent verification, SharedRail allows users and institutions to send and receive payments using verified email identities while maintaining full transparency, auditability, and compliance through open standards. https://roxanneardary.com/sharedrail/

Renders the Evidence Factory group README and its ten scenarios as one site. This project holds no prose; edit gitlab-profile.

Vibe Sec Ops: the methodology Foxx Cyber uses to ship software written with AI coding agents. Rulebook, machine-enforced gates, evidence, accepted-risk registers and POA&Ms. Not vibe coding.

Chapter 1: the governed CI/CD Catalog and the evidence line. Published, pinned components every workload builds from.

G.U.A.R.D. is an automated Compliance-as-Code verification tool designed for cloud-native software. It bridges the semantic gap between qualitative regulatory frameworks (such as NEN 7510 and ISO 27001) and deterministic software controls by mapping compliance requirements directly to specific code symbols (anchors) and enforcing them within CI/CD pipelines.

Chapter 2: the policy plane. The NIST 800-53 framework, the Pipeline Execution Policy that injects the line, and the approval gates.