Open source compliance projects

Lynis - Security auditing tool for Linux, macOS, and UNIX-based systems. Assists with compliance testing (HIPAA/ISO27001/PCI DSS) and system hardening. Agentles

Prowler is the world’s most widely used open-source cloud security platform that automates security and compliance across any cloud environment.

Open Policy Agent (OPA) is an open source, general-purpose policy engine.

Prevent cloud misconfigurations and find vulnerabilities during build-time in infrastructure as code, container images and open source packages with Checkov by

Unified Policy as Code

Tfsec is now part of Trivy

AI Agent Governance Toolkit — Policy enforcement, zero-trust identity, execution sandboxing, and reliability engineering for autonomous AI agents. Covers 10/10

Open Source Cloud Native Application Protection Platform (CNAPP)

OSSEC is an Open Source Host-based Intrusion Detection System that performs log analysis, file integrity checking, policy monitoring, rootkit detection, real-ti

Harden Windows Safely, Securely using Official Supported Microsoft methods and proper explanation | Always up-to-date and works with the latest build of Windows

Open-source, self-hosted file-processing tool. Convert, compress, OCR, transcribe & run local AI across image, video, audio, PDF & documents, via UI, REST API &

HardeningKitty and Windows Hardening Settings

Pre-submission compliance scanner for the Apple App Store and Google Play. Scans code, privacy manifests, Android manifests, and IPA/APK/AAB binaries against th

AI agents that transform merchant risk decisions at scale

A suite of tools to automate software compliance checks.

Get audit-ready for SOC 2, ISO 27001, HIPAA, and GDPR

Self-hosted collaborative password manager for teams: folder-level access control, AES-256-GCM encryption, LDAP/AD, OAuth2 SSO, audit trail, REST API, browser e

NIST Certified SCAP 1.2 toolkit

Appshark is a static taint analysis platform to scan vulnerabilities in an Android app.

🧵 CLI tool for directly patching container images!

Secure Vault for Customer PII/PHI/PCI/KYC Records

Decision audit trail + persistent memory for AI trading agents. Outcome-weighted recall, tamper-evident SHA-256 chain with RFC 3161 anchoring, 20 MCP tools.

The open‑source AI Agents Governance & Orchestration framework: write the rules declaratively, Bernstein enforces them and produces the verifiable, replayable r

OWASP dep-scan is a next-generation security and risk audit tool based on known vulnerabilities, advisories, and license limitations for project dependencies. B

FOSSology is an open source license compliance software system and toolkit. As a toolkit you can run license, copyright and export control scans from the comma

Ruby gem & CLI to detect a project's open source license (SPDX) from LICENSE files, package manifests, and READMEs

Attestix - Attestation Infrastructure for AI Agents. DID-based agent identity, W3C Verifiable Credentials, EU AI Act compliance layer, delegation chains, and re

Rudder is a configuration and security automation platform. Manage your Cloud, hybrid or on-premises infrastructure in a simple, scalable and dynamic way.

Open Source Static Scanning tool to detect data flows in your code, find data security vulnerabilities & generate accurate Play Store Data Safety Report.

Real-time fraud detection and AML compliance engine

SDLC evidence store and policy engine for your Software Supply Chain attestations, SBOMs, VEX, SARIF, QA reports, and more

Enterprise-ready SIEM, SOAR and Compliance powered by real-time correlation and threat intelligence.

Plugins for Wazuh Dashboard

🛡⚔️AI-Powered Penetration Testing Framework with automated vulnerability scanning, multi-agent system, and compliance reporting🛡⚔️

AI governance made simple, secure, and compliant