Audit Labs / gh-attest

Your GitHub settings,
as audit evidence.

A read-only GitHub App that records branch protection, scanning alerts, and organization access as they change — maps each signal to SOC 2 and ISO 27001 controls, and exports point-in-time CSV and PDF evidence packages. It never modifies your repositories, permissions, or membership.

# Changes are recorded as they happen
▸ branch protection enabled  repo/app · main
   → SOC 2 CC8.1 · ISO 27001 A.8.32
▸ secret scanning alert resolved  repo/api
   → SOC 2 CC6.1, CC6.6 · ISO A.5.17
──────────────────────────────
# Export a point-in-time package
✓ evidence package → acme_2026-08.csv + .pdf
How it works

Capture, map, export.

Evidence accrues on its own — you install the app once and pull a package whenever an auditor asks.

01 · CAPTURE

As it changes

Webhooks record branch protection, rulesets, and scanning alerts the moment they change. An hourly cron polls for state webhooks never announce — protection that predates install, and current membership — storing each as a timestamped snapshot.

02 · MAP

To the controls

Each signal is mapped to SOC 2 and ISO 27001 controls with a plain-language rationale. Mappings apply as a join at query time, so one can be corrected without re-ingesting history.

03 · EXPORT

Auditor-ready

Point-in-time CSV and PDF evidence packages, rendered off the request path via a queue. Every export reflects the exact state at the moment you asked — not just today’s.

What it collects

Signals, and the controls they evidence.

Every mapping — and why each signal is defensible evidence for its control — is documented alongside the machine-readable version in the repo.

Branch protection
Protection rules and repository rulesets. SOC 2 CC8.1 · ISO 27001 A.8.32
Secret scanning
Secret scanning alerts and push protection. SOC 2 CC6.1, CC6.6 · ISO A.5.17
Dependabot
Dependency vulnerability alerts. SOC 2 CC7.1, CC7.2 · ISO A.8.8
Code scanning
Code scanning alerts from CodeQL and partners. SOC 2 CC7.1 · ISO A.8.28, A.8.29
Access
Organization and team membership over time. SOC 2 CC6.2, CC6.3 · ISO A.5.18
Inventory
Repository inventory and visibility. ISO 27001 A.5.9
Maps GitHub signals to
SOC 2 ISO 27001
Get started

Install once, evidence accrues.

# 1. Install the GitHub App on your org
#    (read-only, least-privilege scopes)
# 2. Select the repositories to cover
# 3. Snapshots begin immediately
# 4. Export a package whenever you need one
TypeScript Cloudflare Workers D1 R2 GPL-3.0

Read-only, by design — what it never does:

Never modifies your repositories or their contents.
Never changes permissions, teams, or membership.
Requests the minimum read scopes to observe configuration.

Prefer to run audits yourself? audit-report turns offline evidence packages into the same control-mapped reports.

Rather not trust our tenant? Self-host it in your own Cloudflare account — it’s a single Worker with D1 and R2. Privacy and security policies apply to the hosted instance.