audit-labs/audit-labs.dev
clone: git clone https://gitbay.org/audit-labs/audit-labs.dev.git
main: index.html · raw
1<!DOCTYPE html>
2<html lang="en">
3<head>
4 <meta charset="UTF-8">
5 <meta name="viewport" content="width=device-width, initial-scale=1.0">
6 <title>Audit Labs | Open-source audit evidence toolchain</title>
7 <meta name="description" content="An open-source toolchain for audit evidence: collect it from real systems, seal it tamper-evident, map it to SOC 2 / ISO 27001 / NIST controls, and measure how much of a framework you actually cover.">
8 <a rel="me" href="https://c.im/@cmc"></a>
9 <link rel="preconnect" href="https://fonts.googleapis.com">
10 <link href="https://fonts.googleapis.com/css2?family=IBM+Plex+Mono:wght@400;500;700&family=DM+Serif+Display:ital@0;1&family=DM+Sans:wght@400;500;600&display=swap" rel="stylesheet">
11 <link rel="stylesheet" href="assets/site.css">
12</head>
13<body>
14
15<nav>
16 <div class="nav-inner">
17 <a href="/" class="logo">AUDIT<span>LABS</span></a>
18 <ul class="nav-links">
19 <li><a href="https://github.com/audit-labs" class="btn-github">GitHub →</a></li>
20 </ul>
21 </div>
22</nav>
23
24<header class="hero">
25 <div class="hero-inner">
26 <div class="hero-label">Open-source · Free to use</div>
27 <h1>Automate the<br><em>evidence trail.</em></h1>
28 <p class="hero-desc">
29 An open-source toolchain for audit evidence — collect it from real systems, seal it tamper-evident, map it to SOC 2, ISO 27001 & NIST controls, and measure how much of a framework you actually cover. Built for the auditor on the other side.
30 </p>
31 <div class="hero-actions">
32 <a href="#repos" class="btn-primary">Explore the tools</a>
33 <a href="/walkthrough/" class="btn-secondary">See it in action</a>
34 <a href="https://github.com/audit-labs/tutorials" class="btn-secondary">See tutorials</a>
35 </div>
36
37 <div class="ecosystem" role="img" aria-label="The Audit Labs pipeline: audit-tools collects evidence into a CSV package; evidence-seal seals and verifies that package; audit-report turns each package into a control-mapped JSON report; one or more reports form a corpus that control-coverage turns into a coverage percentage, blind spots, a Statement of Applicability, trend, and crosswalk.">
38 <div class="eco-cap">One pipeline · collect → seal → report → measure</div>
39
40 <div class="eco-node">
41 <span class="eco-icon" aria-hidden="true"><svg width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.7" stroke-linecap="round" stroke-linejoin="round"><ellipse cx="12" cy="5" rx="8" ry="3"/><path d="M4 5v6c0 1.7 3.6 3 8 3s8-1.3 8-3V5"/><path d="M4 11v6c0 1.7 3.6 3 8 3s8-1.3 8-3v-6"/></svg></span>
42 <div class="eco-main">
43 <span class="eco-name">audit-tools</span>
44 <span class="eco-role">Collect evidence — cloud, GitHub, databases & OS</span>
45 </div>
46 </div>
47
48 <div class="eco-connector"></div>
49 <span class="eco-artifact">CSV evidence package</span>
50 <div class="eco-connector"></div>
51
52 <div class="eco-node eco-node--seal">
53 <span class="eco-icon" aria-hidden="true"><svg width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.7" stroke-linecap="round" stroke-linejoin="round"><path d="M12 3l7 3v5c0 4.5-3 7.5-7 9-4-1.5-7-4.5-7-9V6z"/><path d="M9 12l2 2 4-4"/></svg></span>
54 <div class="eco-main">
55 <span class="eco-name">evidence-seal <span class="eco-optional">optional</span></span>
56 <span class="eco-role">Seal & verify integrity</span>
57 </div>
58 </div>
59
60 <div class="eco-connector"></div>
61 <span class="eco-artifact eco-artifact--dashed">tamper-evident package</span>
62 <div class="eco-connector"></div>
63
64 <div class="eco-node">
65 <span class="eco-icon" aria-hidden="true"><svg width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.7" stroke-linecap="round" stroke-linejoin="round"><path d="M14 3H7a2 2 0 0 0-2 2v14a2 2 0 0 0 2 2h10a2 2 0 0 0 2-2V8z"/><path d="M14 3v5h5"/><path d="M9 13h6M9 17h6"/></svg></span>
66 <div class="eco-main">
67 <span class="eco-name">audit-report</span>
68 <span class="eco-role">Map findings to SOC 2, ISO 27001 & NIST → JSON</span>
69 </div>
70 </div>
71
72 <div class="eco-connector"></div>
73 <span class="eco-artifact">one or more reports = a corpus</span>
74 <div class="eco-connector"></div>
75
76 <div class="eco-node eco-node--flagship">
77 <span class="eco-icon" aria-hidden="true"><svg width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.7" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="8"/><circle cx="12" cy="12" r="4"/><circle cx="12" cy="12" r="1" fill="currentColor" stroke="none"/></svg></span>
78 <div class="eco-main">
79 <span class="eco-name">control-coverage</span>
80 <span class="eco-role">Score the corpus against whole frameworks</span>
81 </div>
82 </div>
83
84 <div class="eco-outputs">
85 <span>coverage %</span>
86 <span>blind spots</span>
87 <span>Statement of Applicability</span>
88 <span>trend</span>
89 <span>crosswalk</span>
90 </div>
91 </div>
92 </div>
93</header>
94
95<section class="repos" id="repos">
96 <div class="section-inner">
97 <div class="section-header">
98 <h2>Six repos.<br>Pick what you need.</h2>
99 <a href="https://github.com/audit-labs" class="section-link">View all on GitHub →</a>
100 </div>
101 <p class="lede" style="margin: -0.5rem 0 2.4rem;">Each tool does one job and hands off to the next — run a single step or the whole chain, from collecting evidence to measuring control coverage.</p>
102 <div class="repo-grid">
103 <a href="https://github.com/audit-labs/audit-tools" class="repo-card">
104 <div class="repo-tag">Collect</div>
105 <h3>audit-labs/audit-tools</h3>
106 <p>Ready-to-run scripts for common audit procedures: pseudo-random sampling, GITC extraction, database user access, Linux OS reports, and more. Gathers raw evidence into CSV packages — use as-is or adapt to your environment.</p>
107 <div class="repo-langs">
108 <span class="lang-badge">Python</span>
109 <span class="lang-badge">Shell</span>
110 <span class="lang-badge">SQL</span>
111 </div>
112 </a>
113 <a href="/evidence-seal/" class="repo-card">
114 <div class="repo-tag">Seal</div>
115 <h3>audit-labs/evidence-seal</h3>
116 <p>Tamper-evident seals and chain of custody for evidence packages. SHA-256 Merkle manifests catch any change to any file; sequential seals chain into a verifiable history; optional ed25519 signing and RFC 3161 timestamping prove who sealed it and when.</p>
117 <div class="repo-langs">
118 <span class="lang-badge">Python</span>
119 <span class="lang-badge">ed25519</span>
120 <span class="lang-badge">RFC 3161</span>
121 </div>
122 </a>
123 <a href="/audit-report/" class="repo-card">
124 <div class="repo-tag">Report</div>
125 <h3>audit-labs/audit-report</h3>
126 <p>Turns an audit-tools evidence package into a control-mapped, auditor-ready report — Markdown, self-contained HTML, or JSON. Declarative rulesets map findings to SOC 2, ISO 27001, and NIST 800-53, with diff and trend modes for tracking drift over time.</p>
127 <div class="repo-langs">
128 <span class="lang-badge">Python</span>
129 <span class="lang-badge">YAML</span>
130 <span class="lang-badge">HTML</span>
131 </div>
132 </a>
133 <a href="/control-coverage/" class="repo-card">
134 <div class="repo-tag">Measure</div>
135 <h3>audit-labs/control-coverage</h3>
136 <p>Control-first coverage analysis. Scores an evidence corpus against the complete catalog of a framework's controls — SOC 2, ISO 27001, NIST 800-53 — to report a true coverage percentage, the blind spots no finding touches, and a Statement of Applicability. Reads audit-report JSON.</p>
137 <div class="repo-langs">
138 <span class="lang-badge">Python</span>
139 <span class="lang-badge">YAML</span>
140 <span class="lang-badge">HTML</span>
141 </div>
142 </a>
143 <a href="/gh-attest/" class="repo-card">
144 <div class="repo-tag">GitHub App</div>
145 <h3>audit-labs/gh-attest</h3>
146 <p>A read-only GitHub App that collects continuously — turning your GitHub security configuration into compliance evidence. Captures branch protection, scanning alerts, and org access over time, maps them to SOC 2 and ISO 27001 controls, and exports CSV and PDF evidence packages.</p>
147 <div class="repo-langs">
148 <span class="lang-badge">TypeScript</span>
149 <span class="lang-badge">Cloudflare</span>
150 <span class="lang-badge">D1</span>
151 </div>
152 </a>
153 <a href="https://github.com/audit-labs/tutorials" class="repo-card">
154 <div class="repo-tag">Learn</div>
155 <h3>audit-labs/tutorials</h3>
156 <p>Step-by-step guides on building your own audit automation using Python, the CLI, and APIs. Good starting point if you're new to scripting or want to extend any of the tools above.</p>
157 <div class="repo-langs">
158 <span class="lang-badge">Jupyter</span>
159 <span class="lang-badge">Python</span>
160 <span class="lang-badge">Markdown</span>
161 </div>
162 </a>
163 </div>
164 </div>
165</section>
166
167<section class="tools">
168 <div class="section-inner">
169 <div class="tools-intro">
170 <h2>Inside audit-tools</h2>
171 <p>Step one of the pipeline — the collectors that pull raw evidence from the systems auditors most commonly deal with. New systems are added over time.</p>
172 </div>
173 <div class="tool-list">
174 <div class="tool-item">
175 <div class="tool-icon">[ AWS ]</div>
176 <h4>AWS</h4>
177 <p>IAM users, password policy, and public S3 buckets — the cloud identity and configuration evidence auditors ask for first.</p>
178 </div>
179 <div class="tool-item">
180 <div class="tool-icon">[ GH ]</div>
181 <h4>GitHub</h4>
182 <p>Administrators, members, branch protection settings, and audit-log events — SDLC and change-management evidence.</p>
183 </div>
184 <div class="tool-item">
185 <div class="tool-icon">[ DB ]</div>
186 <h4>Databases</h4>
187 <p>User access, privilege levels, password rotation checks — for PostgreSQL, MySQL, and others.</p>
188 </div>
189 <div class="tool-item">
190 <div class="tool-icon">[ OS ]</div>
191 <h4>Linux / OS</h4>
192 <p>Shell scripts to generate system reports: users, groups, sudoers, login history, and more.</p>
193 </div>
194 <div class="tool-item">
195 <div class="tool-icon">[ ~ ]</div>
196 <h4>Sampling</h4>
197 <p>Reproducible pseudo-random sampling with a fixed seed — a core procedure for most audits.</p>
198 </div>
199 <div class="tool-item">
200 <div class="tool-icon">[ PM ]</div>
201 <h4>Project Management</h4>
202 <p>Tracking and visualization utilities for audit project data and findings.</p>
203 </div>
204 <div class="tool-item">
205 <div class="tool-icon">[ APP ]</div>
206 <h4>Applications</h4>
207 <p>Scripts targeting specific application-layer controls across common enterprise software.</p>
208 </div>
209 <div class="tool-item">
210 <div class="tool-icon">[ + ]</div>
211 <h4>Contributions welcome</h4>
212 <p>Fork, add a script for your stack, and open a PR. All audit-relevant tools considered.</p>
213 </div>
214 </div>
215 </div>
216</section>
217
218<section class="frameworks">
219 <div class="frameworks-inner">
220 <span class="frameworks-label">Built to produce evidence for</span>
221 <div class="frameworks-list">
222 <span class="framework-tag">SOX</span>
223 <span class="framework-tag">SOC 1 / 2</span>
224 <span class="framework-tag">ISO 27001</span>
225 <span class="framework-tag">NIST 800-53</span>
226 <span class="framework-tag">ITGC</span>
227 </div>
228 </div>
229</section>
230
231<footer>
232 <div class="footer-inner">
233 <div class="footer-left">
234 <a href="/" class="footer-logo">AUDIT<span>LABS</span></a>
235 <p>© 2026 Audit Labs — an independent, open-source project built for the community.</p>
236 <p class="footer-note">Not affiliated with, sponsored by, or endorsed by any employer, framework body (AICPA, ISO, NIST), or cloud provider. Framework mappings are our own interpretation.</p>
237 </div>
238 <div class="footer-links">
239 <a href="https://github.com/audit-labs">GitHub</a>
240 <a href="mailto:security@audit-labs.dev">Security</a>
241 </div>
242 </div>
243</footer>
244
245</body>
246</html>