audit-labs/audit-labs.dev
The website for Audit Labs.
clone: git clone https://gitbay.org/audit-labs/audit-labs.dev.git
main: gh-attest/index.html · raw
1<!DOCTYPE html>
2<html lang="en">
3<head>
4 <meta charset="UTF-8">
5 <meta name="viewport" content="width=device-width, initial-scale=1.0">
6 <title>gh-attest | Audit Labs</title>
7 <meta name="description" content="A read-only GitHub App that turns your security configuration into auditor-ready evidence — branch protection, scanning alerts, and org access recorded over time and mapped to SOC 2 and ISO 27001 controls.">
8 <link rel="preconnect" href="https://fonts.googleapis.com">
9 <link href="https://fonts.googleapis.com/css2?family=IBM+Plex+Mono:wght@400;500;700&family=DM+Serif+Display:ital@0;1&family=DM+Sans:wght@400;500;600&display=swap" rel="stylesheet">
10 <link rel="stylesheet" href="../assets/site.css">
11</head>
12<body>
13
14<nav>
15 <div class="nav-inner">
16 <a href="/" class="logo">AUDIT<span>LABS</span></a>
17 <ul class="nav-links">
18 <li><a href="https://github.com/audit-labs/gh-attest" class="btn-github">View on GitHub →</a></li>
19 </ul>
20 </div>
21</nav>
22
23<header class="hero split">
24 <div class="hero-inner">
25 <div>
26 <div class="crumb"><a href="/">Audit Labs</a> / gh-attest</div>
27 <h1>Your GitHub settings,<br><em>as audit evidence.</em></h1>
28 <p class="hero-desc">
29 A read-only GitHub App that records branch protection, scanning alerts, and
30 organization access as they change — maps each signal to SOC 2 and
31 ISO 27001 controls, and exports point-in-time CSV and PDF evidence packages.
32 It never modifies your repositories, permissions, or membership.
33 </p>
34 <div class="hero-actions">
35 <a href="https://github.com/audit-labs/gh-attest" class="btn-primary">View on GitHub</a>
36 <a href="#collect" class="btn-secondary">What it collects</a>
37 </div>
38 </div>
39 <div class="terminal">
40 <div class="terminal-bar"><div class="dot dot-red"></div><div class="dot dot-yellow"></div><div class="dot dot-green"></div></div>
41 <div class="terminal-body">
42 <span class="t-comment"># Changes are recorded as they happen</span><br>
43 <span class="t-out">▸ branch protection enabled</span><span class="t-hash"> repo/app · main</span><br>
44 <span class="t-path"> → SOC 2 CC8.1 · ISO 27001 A.8.32</span><br>
45 <span class="t-out">▸ secret scanning alert resolved</span><span class="t-hash"> repo/api</span><br>
46 <span class="t-path"> → SOC 2 CC6.1, CC6.6 · ISO A.5.17</span><br>
47 <span class="t-dim">──────────────────────────────</span><br>
48 <span class="t-comment"># Export a point-in-time package</span><br>
49 <span class="t-out">✓ evidence package → </span><span class="t-path">acme_2026-08.csv + .pdf</span>
50 </div>
51 </div>
52 </div>
53</header>
54
55<section>
56 <div class="section-inner">
57 <div class="eyebrow">How it works</div>
58 <h2>Capture, map, export.</h2>
59 <p class="lede">Evidence accrues on its own — you install the app once and pull a package whenever an auditor asks.</p>
60 <div class="guarantees">
61 <div class="card">
62 <div class="num">01 · CAPTURE</div>
63 <h3>As it changes</h3>
64 <p>Webhooks record branch protection, rulesets, and scanning alerts the moment they change. An hourly cron polls for state webhooks never announce — protection that predates install, and current membership — storing each as a timestamped snapshot.</p>
65 </div>
66 <div class="card">
67 <div class="num">02 · MAP</div>
68 <h3>To the controls</h3>
69 <p>Each signal is mapped to SOC 2 and ISO 27001 controls with a plain-language rationale. Mappings apply as a join at query time, so one can be corrected without re-ingesting history.</p>
70 </div>
71 <div class="card">
72 <div class="num">03 · EXPORT</div>
73 <h3>Auditor-ready</h3>
74 <p>Point-in-time CSV and PDF evidence packages, rendered off the request path via a queue. Every export reflects the exact state at the moment you asked — not just today’s.</p>
75 </div>
76 </div>
77 </div>
78</section>
79
80<section class="cmds" id="collect">
81 <div class="section-inner">
82 <div class="eyebrow">What it collects</div>
83 <h2>Signals, and the controls they evidence.</h2>
84 <p class="lede">Every mapping — and why each signal is defensible evidence for its control — is documented alongside the machine-readable version in the repo.</p>
85 <div class="cmd-list">
86 <div class="cmd-row"><div class="cmd-name">Branch protection</div><div class="cmd-desc">Protection rules and repository rulesets. <span class="mono">SOC 2 CC8.1 · ISO 27001 A.8.32</span></div></div>
87 <div class="cmd-row"><div class="cmd-name">Secret scanning</div><div class="cmd-desc">Secret scanning alerts and push protection. <span class="mono">SOC 2 CC6.1, CC6.6 · ISO A.5.17</span></div></div>
88 <div class="cmd-row"><div class="cmd-name">Dependabot</div><div class="cmd-desc">Dependency vulnerability alerts. <span class="mono">SOC 2 CC7.1, CC7.2 · ISO A.8.8</span></div></div>
89 <div class="cmd-row"><div class="cmd-name">Code scanning</div><div class="cmd-desc">Code scanning alerts from CodeQL and partners. <span class="mono">SOC 2 CC7.1 · ISO A.8.28, A.8.29</span></div></div>
90 <div class="cmd-row"><div class="cmd-name">Access</div><div class="cmd-desc">Organization and team membership over time. <span class="mono">SOC 2 CC6.2, CC6.3 · ISO A.5.18</span></div></div>
91 <div class="cmd-row"><div class="cmd-name">Inventory</div><div class="cmd-desc">Repository inventory and visibility. <span class="mono">ISO 27001 A.5.9</span></div></div>
92 </div>
93 </div>
94</section>
95
96<section class="frameworks">
97 <div class="frameworks-inner">
98 <span class="frameworks-label">Maps GitHub signals to</span>
99 <div class="frameworks-list">
100 <span class="framework-tag">SOC 2</span>
101 <span class="framework-tag">ISO 27001</span>
102 </div>
103 </div>
104</section>
105
106<section class="install" id="start">
107 <div class="section-inner">
108 <div class="eyebrow">Get started</div>
109 <h2>Install once, evidence accrues.</h2>
110 <div class="install-grid">
111 <div>
112 <pre><span class="c"># 1. Install the GitHub App on your org</span>
113<span class="c"># (read-only, least-privilege scopes)</span>
114<span class="c"># 2. Select the repositories to cover</span>
115<span class="c"># 3. Snapshots begin immediately</span>
116<span class="c"># 4. Export a package whenever you need one</span></pre>
117 <div class="badges">
118 <span class="badge">TypeScript</span>
119 <span class="badge">Cloudflare Workers</span>
120 <span class="badge">D1</span>
121 <span class="badge">R2</span>
122 <span class="badge">GPL-3.0</span>
123 </div>
124 </div>
125 <div>
126 <p class="lede">Read-only, by design — what it never does:</p>
127 <div class="exit">
128 <div class="e"><span class="code g">✓</span><span>Never modifies your repositories or their contents.</span></div>
129 <div class="e"><span class="code g">✓</span><span>Never changes permissions, teams, or membership.</span></div>
130 <div class="e"><span class="code g">✓</span><span>Requests the minimum read scopes to observe configuration.</span></div>
131 </div>
132 <p class="lede" style="margin-top:1.4rem; font-size:.9rem;">
133 Prefer to run audits yourself?
134 <a href="/audit-report/" style="color:var(--amber); text-decoration:none;">audit-report</a>
135 turns offline evidence packages into the same control-mapped reports.
136 </p>
137 <p class="lede" style="margin-top:.8rem; font-size:.9rem;">
138 Rather not trust our tenant?
139 <a href="https://github.com/audit-labs/gh-attest#deployment" style="color:var(--amber); text-decoration:none;">Self-host it</a>
140 in your own Cloudflare account — it’s a single Worker with D1 and R2.
141 <a href="https://github.com/audit-labs/gh-attest/blob/main/PRIVACY.md" style="color:var(--amber); text-decoration:none;">Privacy</a>
142 and
143 <a href="https://github.com/audit-labs/gh-attest/blob/main/SECURITY.md" style="color:var(--amber); text-decoration:none;">security</a>
144 policies apply to the hosted instance.
145 </p>
146 </div>
147 </div>
148 </div>
149</section>
150
151<footer>
152 <div class="footer-inner">
153 <div class="footer-left">
154 <a href="/" class="footer-logo">AUDIT<span>LABS</span></a>
155 <p>© 2026 Audit Labs — an independent, open-source project built for the community.</p>
156 </div>
157 <div class="footer-links">
158 <a href="/">Home</a>
159 <a href="https://github.com/audit-labs">GitHub</a>
160 <a href="https://github.com/audit-labs/gh-attest/blob/main/PRIVACY.md">Privacy</a>
161 <a href="https://github.com/audit-labs/gh-attest/blob/main/SECURITY.md">Security</a>
162 </div>
163 </div>
164</footer>
165
166</body>
167</html>