Platforms Overview
opensecstack ships 11 security platforms plus two cross-cutting layers (sinauth for identity and CITADEL for governance). All platforms are at v1.0.0 production. Tool platforms are licensed under Apache 2.0 so they can be embedded in CI/CD pipelines; governance platforms are AGPL-3.0 so modifications to the audit trail and compliance reporting remain open source.
All platforms
| Platform | Purpose | Stack | Licence |
|---|---|---|---|
| APIGuard | API security testing — OWASP API Top 10 (A1–A10), CVSS 3.1, SARIF/HTML/PDF/JSON reports | Go + Rust + Python + React | Apache 2.0 |
| NIS2 Compass | NIS2 Article 21(2) compliance assessment, evidence management, Article 23 notification | Python + Go + React | AGPL-3.0 |
| IRFlow | Incident response orchestration — playbooks, governed actions, NIS2 72-hour notification | Go + Python | AGPL-3.0 |
| ThreatFlow | Threat intelligence aggregation — IOC ingestion, STIX 2.1, MITRE ATT&CK | Rust + Go | Apache 2.0 |
| OpenScrub | DDoS mitigation at kernel level — XDP/eBPF programs, GoBGP blackhole routing | Rust + C + Go | Apache 2.0 |
| CyberPath | Security training — Docker/Wasm labs, NIS2 Art. 21(2)(g) evidence records | Go + React + Python | Apache 2.0 |
| SecureLab | Attack simulation & detection validation — MITRE ATT&CK scenario library | Python + Rust + Go | Apache 2.0 |
| OpenCSIRT | National/sector CSIRT operations — TAXII 2.1, STIX 2.1, CSAF 2.0 advisory generation | Go + Python | AGPL-3.0 |
| VertGuard | AI-attack defence — deepfake detection, prompt injection (OWASP LLM Top 10), MITRE ATLAS threat feed, C2PA media authenticity | Go + Rust + Python | AGPL-3.0 |
| SIN Community | Developer knowledge hub — posts, tags, full-text search (Meilisearch), notifications, TOTP, API keys, spaces | Go + React + TypeScript + PostgreSQL | Apache 2.0 |
API security & compliance
APIGuard is the entry point for most security workflows. It parses OpenAPI 3.x and Swagger 2.0 specs through a Rust-powered parser, runs a 10-layer testing pipeline (HTTP engine, authentication analysis, input validation, OWASP module runner, and more), and produces findings with CVSS 3.1 scores and full remediation guidance. Reports are available in JSON, SARIF, HTML, and PDF for CI/CD integration.
NIS2 Compass manages the 10 security measures required by NIS2 Article 21(2). It maintains an evidence vault where APIGuard scan results, CyberPath training records, and manual artifacts are linked to specific controls. When a critical incident triggers Article 23 notification requirements, it coordinates with IRFlow to track the 72-hour reporting deadline. Every compliance state change is anchored in the CITADEL WORM chain for auditor access.
Incident response & threat intelligence
IRFlow orchestrates incident response through a graph-based playbook executor with branching logic and per-step timeouts. It ingests HMAC-signed webhooks from APIGuard, CITADEL, and ThreatFlow. Every governed action inside a playbook (deploy a mitigation, update a control) is evaluated by CITADEL MARSHAL before execution. IRFlow implements the five canonical RBAC roles used across the ecosystem: admin, operator, verifier, viewer, and service.
ThreatFlow aggregates threat intelligence from MISP, AlienVault OTX, VirusTotal, and custom feeds. It normalises IOCs to STIX 2.1 bundles, maps techniques to MITRE ATT&CK, and distributes enriched feeds downstream: OpenScrub receives auto-block rules, IRFlow receives incident enrichment, and OpenCSIRT receives advisory inputs.
Network defence, training & simulation
OpenScrub operates at the kernel level, using XDP/eBPF programs written in C and Rust/Aya for packet-level filtering and GoBGP for blackhole route announcements. It receives auto-block rules from ThreatFlow IOC bundles and validated DDoS rule sets from SecureLab simulations.
CyberPath delivers security training through Docker and WebAssembly labs. Content is authored as YAML + Markdown. Completion records are SDK-typed TrainingRecord events that feed NIS2 Compass as Art. 21(2)(g) evidence and are anchored in CITADEL for the audit trail.
SecureLab runs attack simulations mapped to the MITRE ATT&CK framework and validates detection rules across the ecosystem: OpenScrub DDoS rules, APIGuard detection patterns, ThreatFlow correlation rules, and VertGuard AI-attack patterns. Simulation results are typed SimulationResult events consumed by IRFlow, OpenScrub, ThreatFlow, and VertGuard.
CSIRT, AI defence & community
OpenCSIRT provides national and sector CSIRT operations: a TAXII 2.1 server and client, STIX 2.1 object model, CSAF 2.0 advisory generation, and NIS2 Article 23 aggregate reporting. Advisories flow into ThreatFlow as an IOC pipeline and cross-border AI attack incidents are coordinated with VertGuard.
VertGuard defends against AI-specific attacks across five modules: media authenticity (C2PA + deepfake detection), AI phishing detection, prompt injection defence (OWASP LLM Top 10), AI threat intelligence feed (MITRE ATLAS), and synthetic identity detection. High-confidence AI-attack detections auto-create incidents in IRFlow and feed CITADEL as evidence via the Content Provenance (C2PA) contract.
SIN Community is the developer knowledge hub at sin.to. It provides posts, comments, tags, full-text search powered by Meilisearch, spaces, notification feeds, TOTP two-factor authentication, and API key management for integrations. It is the 11th opensecstack platform and the community's primary collaboration space.
Cross-cutting layers
Two components span every platform in the ecosystem:
- sinauth (Go + PostgreSQL, Apache 2.0) — the identity layer. A dedicated OAuth 2.0 / OpenID Connect authorization server that provides single sign-on for all platforms. RS256-signed tokens, JWKS endpoint, PKCE, TOTP MFA, Google and GitHub social login. As of v1.1, it also recognizes organizations (government, private, e-commerce, NGO) as identity subjects alongside individual users, with optional org-scoped token claims and an org picker for users belonging to more than one organization. What Auth0 is globally, sinauth is for the SIN ecosystem. See Identity (sinauth).
- CITADEL (Go, AGPL-3.0) — the governance layer. Every privileged action across all platforms is evaluated by the MARSHAL 5-gate engine and recorded in an append-only WORM audit chain with TripleHash integrity (SHA-256 + SHA-512 + BLAKE3) and Ed25519 chain anchors. NDS enforces separation of duties at the protocol level. See Governance (CITADEL).