Open-source GRC toolkit from the GRC Engineering Club. Claude Code plugins for evidence collection, SCF crosswalks, multi-framework gap reports, OSCAL workflows.

Transilience — Shasta is the open-source pre-GA AI and Cloud Security platform. Supports GCP, AWS, and Azure and 14 security & compliance frameworks

Open Source AWS Control Tower

Minimalist containerized implementation of Prowler from https://github.com/toniblyx/prowler, made to run within ECS Fargate and have Secrets passed via AWS Secrets Manager

Docker Build for GRC Tool - Eramba is a tool that helps with compliance, risk management, control testing, exception management, etc.

Cybersecurity Standards — independent third-party profile of a public API surface, by API Evangelist. Cybersecurity Standards captures the public, machine-readable, and reference frameworks that establish best practices for protecting information systems, networks, software, and data from cyber threats. The landscape is anchored by U.S.

Open-source AI agent skill that automates compliance evidence collection for Vanta audits (captures screenshots, generates explainer PDFs, uploads drafts for review). Not affiliated with Vanta.

Augmedix — independent third-party profile of a public API surface, by API Evangelist. Augmedix is a San Francisco-based health technology company providing ambient AI medical documentation (AI scribe) services that capture patient-clinician conversations and generate clinical notes so that physicians can focus on patient care instead of EHR data e

Vital is a patient-experience technology company for healthcare providers, delivering AI-powered patient guidance and communication across the hospital journey: emergency, inpatient, urgent care, patient access, care coordination, and post-discharge monitoring (Vital Guard).

Open Source compliance assessment portal

Run automated checks on logs, infra, and configs for potential technical risks 🏥✨ BaaStream helps engineering and security teams identify potential technical risks in infrastructure and logs. It validates infrastructure configurations and log patterns against industry best practices and security frameworks such as HIPAA, GDPR, and SOC2.

Inject secrets from pass or passage into environment variables at runtime without storing plaintext secrets on disk.

Cleardata — independent third-party profile of a public API surface, by API Evangelist. ClearDATA is healthcare's dedicated cloud security, compliance, and operations partner, helping providers, payers, health-tech software companies, medical device makers, and life sciences organizations build and run on AWS, Microsoft Azure, and Google Cloud in a

Cloudit automates compliance with evidence collection. Cloudit streamlines vulnerability tracking, audit workflows, and compliance reporting by gathering artifacts, comparing findings, and generating actionable plans—keeping your organization audit-ready at all times.

Microsoft Azure Health Data Services — independent third-party profile of a public API surface, by API Evangelist. Microsoft Azure Health Data Services is a cloud-based suite of managed API services built on open healthcare standards (FHIR R4, DICOM, HL7) that enables healthcare organizations to collect, store, analyze, and exchange protected healt

Multi-cloud healthcare security engineering lab aligned with HIPAA Security Rule and HITRUST CSF objectives, using synthetic ePHI, AWS, GCP, Terraform, and evidence-driven security validation.