Open-Source
Security &
Compliance
Open-source security and compliance infrastructure for teams that need to prove — not just claim — they're secure.
A full platform ecosystem with a shared, immutable governance chain — built for the EU Digital Decade.
Ecosystem Platforms
11 active, 0 planned — all connected through CITADEL governance.
APIGuard
activeAutomated OWASP API Top 10 (A1–A10) detection with Rust-powered parsing and Go orchestration. CVSS 3.1 scoring, SARIF/HTML/PDF/JSON reports, and CI/CD integration.
NIS2 Compass
activeFull NIS2 Article 21(2) assessment lifecycle — 10-control framework, NIST CSF mapping, evidence vault, Article 23 72-hour notification, and immutable CITADEL audit trail.
IRFlow
activeIncident response orchestration with graph-based playbook executor, HMAC-signed webhook ingestion, JWT + RBAC, and NIS2 Article 23 async 72-hour notification tracking.
ThreatFlow
activeThreat intelligence aggregation and IOC correlation. MISP, AlienVault OTX, VirusTotal ingestion, STIX 2.1 bundles, TAXII 2.1, and MITRE ATT&CK technique mapping.
OpenScrub
activeKernel-level DDoS mitigation using XDP/eBPF programs and GoBGP blackhole routing. FastNetMon detection integration and CITADEL-governed rule lifecycle.
CyberPath
activeSecurity training platform with Docker and Wasm labs, skill assessments, and certification tracking. NIS2 Article 21(2)(g) evidence records anchored in CITADEL.
SecureLab
activeAttack simulation and detection validation. MITRE ATT&CK scenario library validates OpenScrub DDoS rules, APIGuard detection, and VertGuard AI-attack patterns.
OpenCSIRT
activeNational and sector CSIRT operations for EU member states. TAXII 2.1 server + client, STIX 2.1, CSAF 2.0 advisory generation, and NIS2 Article 23 aggregate reporting.
VertGuard
activeAI-attack defence platform — prompt injection detection (OWASP LLM Top 10), deepfake video/voice detection, C2PA media authenticity, AI threat intelligence feed (MITRE ATLAS), and Zoom/Teams/WebEx plugins.
sinauth
activeSingle sign-on identity layer for the whole ecosystem — OAuth 2.0 / OpenID Connect authorization server. RS256-signed tokens with JWKS, authorization-code + PKCE, social login (Google, GitHub), and TOTP MFA. One account across every SIN platform.
SIN Community
activeDeveloper knowledge hub for the opensecstack community. Posts, comments, tags, full-text search (Meilisearch), notifications, TOTP 2FA, API keys, series, and spaces.
APIGuard
Automated API security scanning that checks every endpoint against the OWASP API Top 10, so vulnerabilities are caught before attackers find them.
OWASP API Top 10 Coverage
Architecture
NIS2 Compass
Assess and document your organization's NIS2 compliance, control by control, with an audit trail regulators can trust — covering the full Article 21(2) assessment lifecycle, with 10 controls mapped to NIST CSF.
10 NIS2 Measures (Art. 21)
Assessment Lifecycle
Report Formats
CITADEL Governance
A fortified centre for the decisions and records that matter most — protecting audit truth, privileged actions, and institutional memory against tampering or loss.
MARSHAL — 5-Gate Evaluation
Name Meaning
A citadel is a fortified centre built to protect what matters. In fiction, it can mean a place where knowledge is preserved. In opensecstack, CITADEL is the cryptographic governance centre that protects audit truth, privileged decisions, and institutional memory.
WORM Chain
Write-Once-Read-Many immutable audit log. SHA-256 hash chain with Ed25519 anchor rotation. Every governance decision is permanently recorded and tamper-detectable.
VIGIL
Ecosystem health monitor — design-stage for v2.0. Not yet implemented; MARSHAL, WORM, NDS, and AUGUR above are live today.
AUGUR
Behavioural heuristics evaluated at Gate 4: off-hours activity, high-frequency actions, and DATA_EXPORT requests without an associated incident. A focused rule set, not a general advisory engine.
Runix
A microkernel-based operating system built for security from the ground up. Every boot, driver load, and privileged syscall is gated by MARSHAL before it's allowed to run.
Desktop
Phase 5Rust microkernel (~50K LOC) + WebAssembly app isolation. 6 security layers. MARSHAL 5-gate at boot. WORM hash chain from firmware to shell.
Mobile + MVNO
Phase 5Rust + ARM TrustZone hardware root of trust. Full MVNO stack with SIM/eSIM governance, VoIP, roaming, and data policies — all CITADEL-gated.
IRFlow
Structured incident response platform for your own security team, covering the full lifecycle from detection to post-mortem with automated playbooks and an evidence chain — including the NIS2-mandated 24h/72h notification steps.
Capabilities
Incident Lifecycle
Evidence Chain
Every incident artefact is hash-linked into an immutable evidence chain. CITADEL WORM log provides tamper-proof custody trail for regulatory proof.
NIS2 Reporting
Automated 24-hour early warning and 72-hour incident notification aligned with NIS2 Directive Article 23 reporting obligations.
ThreatFlow
Real-time threat intelligence platform. IOC ingestion, correlation, and STIX/TAXII sharing so every connected platform blocks the same threats automatically.
Capabilities
Architecture
OpenScrub
Stops DDoS floods before they reach your servers, using kernel-level XDP/eBPF packet filtering and GoBGP blackhole routing for volumetric attacks.
Capabilities
Architecture
CyberPath
Hands-on cybersecurity training platform with interactive labs, skill assessments, and certification tracking. Completion records satisfy NIS2 Article 21(2)(g) cybersecurity-training evidence requirements.
Capabilities
Training Tracks
SecureLab Integration
Live sandbox environments powered by SecureLab. Each lab runs in a CITADEL-governed container with isolated networking and auto-cleanup.
SecureLab
Isolated sandbox environments for malware analysis, vulnerability research, and security testing. Containerised with CITADEL-governed lifecycle.
Capabilities
Architecture
OpenCSIRT
Operations platform for national and EU-level CSIRTs coordinating incidents across organizations and borders, aligned with NIS2 Directive reporting requirements.
Capabilities
NIS2 Reporting
Automated 24-hour early warning and 72-hour incident notification for national competent authorities. Template-driven reporting aligned with ENISA incident taxonomy.
Cross-Border Coordination
Shared IOC feeds via ThreatFlow TAXII. Multi-CSIRT incident handoff with hash-linked evidence chain. EU-CyCLONe integration for large-scale crisis management.
Vulnerability Disclosure
Coordinated vulnerability disclosure (CVD) platform. Researcher submission portal, triage workflow, and public advisory publishing with CVSS scoring from APIGuard.
VertGuard
AI-attack defence platform. Detects prompt injection, deepfakes, and synthetic media at inference time.
Capabilities
Five Modules
Ecosystem Integration
HIGH-confidence detections auto-create incidents in IRFlow. AI-specific IOCs feed ThreatFlow. Evidence envelopes (C2PA + JSON) are anchored in the CITADEL WORM chain. Cross-border AI attack patterns are shared via OpenCSIRT.
sinauth
OAuth2 / OIDC identity provider powering every platform in the ecosystem. Triple-Hash WORM audit, RS256 JWT, PKCE, and federation built-in.
Capabilities
SIN Community
Developer knowledge hub for the opensecstack ecosystem. A self-hosted community platform where practitioners share research, ask questions, and build the open-source security commons.
Capabilities
Architecture
Multi-Language SDKs
Type-safe APIGuard clients with a consistent API across Go, Python, Rust, and TypeScript.
Go
client := sin.NewAPIGuardClient(url, key) scan, _ := client.CreateScan(ctx, specURL)
Python
client = APIGuardClient(url, api_key) scan = client.create_scan(spec_url=url)
Rust
let client = APIGuardClient::new(url, key); let scan = client.create_scan(spec_url).await?;
TypeScript
const client = new APIGuardClient(url, key); const scan = await client.createScan(specUrl);
Roadmap
From the shipped, full-platform v1.2 ecosystem to the post-quantum, sovereignty-focused v3.0 roadmap.