Open-source compliance automation toolkit for SOC 2, ISO 27001, and GDPR
Documentation · Website · Community · Blog
A comprehensive collection of 50+ open-source tools designed to automate compliance workflows, collect evidence, and maintain continuous compliance for SOC 2, ISO 27001, GDPR, HIPAA, and other security frameworks.
Built by compliance practitioners who were tired of:
- ❌ Manual screenshot collection
- ❌ Spreadsheet-based evidence tracking
- ❌ Last-minute audit scrambling
- ❌ Expensive compliance consultants for basic tasks
LowerPlane Compliance Toolkit is:
- ✅ Free & Open Source - MIT licensed
- ✅ Production Ready - Used by companies managing $200M+ in deals
- ✅ Framework Agnostic - Works with any compliance framework
- ✅ Privacy First - Run everything locally or self-hosted
- ✅ Integration Rich - 100+ integrations with cloud providers and SaaS tools
# Clone the repository
git clone https://github.com/lowerplane/compliance-toolkit.git
cd compliance-toolkit
# Build all CLI tools using Makefile
make build-cli
# Or build individual tools
cd tools/cli/soc2-check
go build -o soc2-check ./cmd
cd ../mfa-status
go build -o mfa-status ./cmd
cd ../public-bucket
go build -o public-bucket ./cmd
# Or use the build script for all 33 CLI tools
./BUILD_ALL.sh# macOS/Linux via Homebrew
brew tap lowerplane/tap
brew install lowerplane-toolkit
# Verify installation
soc2-check --version
mfa-status --version
public-bucket --version# Check SOC 2 readiness
./soc2-check --provider aws --region us-east-1
# Check MFA status across all services
./mfa-status --all
# Find public S3 buckets
./public-bucket --provider all# Start PolicyHub
cd tools/cloud/policy-hub
docker-compose up -d
# Frontend: http://localhost:5173
# Backend: http://localhost:3001
# Start AccessReview
cd tools/cloud/access-review
docker-compose up -d
# Backend: http://localhost:3002
# Start VendorRisk
cd tools/cloud/vendor-risk
docker-compose up -d
# Backend: http://localhost:3003
# Start CloudScanner
cd tools/cloud/cloud-scanner
docker-compose up -d
# Backend: http://localhost:3004
# All cloud tools available:
# - PolicyHub, AccessReview, VendorRisk, CloudScanner
# - FrameworkMapper, AuditTrail, TrainingTracker
# - ChangeLog, IncidentResponse, PentestPortalTier 1: High-Impact Security Checks
| Tool | Description | Use Case |
|---|---|---|
soc2-check |
SOC 2 compliance scanner for AWS/GCP/Azure | Pre-audit readiness assessment |
mfa-status |
MFA coverage across all platforms | Verify logical access controls |
public-bucket |
Find publicly accessible cloud storage | Prevent data breaches |
compliance-ci |
CI/CD compliance checks | Shift-left compliance |
api-key-scanner |
Detect exposed secrets in code | Prevent credential leaks |
Tier 2: Evidence Collection
| Tool | Description | Use Case |
|---|---|---|
evidence-cli |
Automated evidence collection | Continuous compliance |
access-last-used |
Find stale accounts | Access review automation |
admin-access |
Audit privileged accounts | Least privilege verification |
audit-export |
Export audit-ready reports | Auditor deliverables |
evidence-hash |
Tamper-proof evidence | Evidence integrity |
Tier 3: Control Testing
| Tool | Description | Use Case |
|---|---|---|
password-policy |
Validate password requirements | CC6.1 compliance |
encrypt-check |
Verify encryption at rest/transit | CC6.1 compliance |
log-retention |
Check log retention periods | CC7.2 compliance |
backup-test |
Verify backup configurations | CC7.5 compliance |
ssl-expiry |
Monitor SSL certificates | Prevent outages |
Tier 4: Specialized Checks
| Tool | Description | Use Case |
|---|---|---|
email-security |
Verify SPF/DKIM/DMARC | Email authentication |
db-encryption |
Check database encryption | Data protection |
container-scan |
Scan containers for CVEs | Supply chain security |
firewall-rules |
Audit firewall changes | Change management |
patch-status |
Check system patch levels | Vulnerability management |
| Tool | Description | Tech Stack |
|---|---|---|
| PolicyHub | Security policy management with version control | React/Node.js/PostgreSQL |
| AccessReview | Automated quarterly access reviews | React/Node.js/PostgreSQL |
| VendorRisk | Third-party vendor risk assessment | React/Node.js/PostgreSQL |
| CloudScanner | Real-time cloud compliance monitoring | React/Node.js/PostgreSQL |
| FrameworkMapper | Map controls across compliance frameworks | React/Node.js/PostgreSQL |
| AuditTrail | Centralized audit logging | React/Node.js/PostgreSQL |
| TrainingTracker | Security awareness training management | React/Node.js/PostgreSQL |
| ChangeLog | Change management tracking | React/Node.js/PostgreSQL |
| IncidentResponse | Security incident management | React/Node.js/PostgreSQL |
| PentestPortal | Penetration testing management | React/Node.js/PostgreSQL |
| Tool | Description | Platform |
|---|---|---|
| ComplianceDesktop | Evidence collection agent | Windows/macOS/Linux |
| SecureClipboard | Compliance screenshot tool | Windows/macOS/Linux |
| BackupVerifier | Backup integrity testing | Windows/macOS/Linux |
| EncryptionChecker | Local encryption audit | Windows/macOS/Linux |
| PasswordAuditor | Password security auditor | Windows/macOS/Linux |
| AssetInventory | IT asset discovery | Windows/macOS/Linux |
| ComplianceSync | Background evidence sync | Windows/macOS/Linux |
┌─────────────────────────────────────────────────────────────────┐
│ LowerPlane Compliance Toolkit │
└─────────────────────────────────────────────────────────────────┘
│
┌───────────────┼───────────────┐
│ │ │
┌───────▼──────┐ ┌─────▼─────┐ ┌──────▼──────┐
│ CLI Tools │ │ Cloud Tools│ │Desktop Tools│
│ (Go/Rust) │ │(React/Node)│ │ (Electron) │
└───────┬──────┘ └─────┬─────┘ └──────┬──────┘
│ │ │
┌───────▼───────────────▼───────────────▼──────┐
│ Integration Layer (APIs) │
└───────────────────┬───────────────────────────┘
│
┌───────────────────▼───────────────────────────┐
│ AWS │ GCP │ Azure │ Okta │ GitHub │ ... │
└───────────────────────────────────────────────┘
CLI Tools:
- Language: Go 1.21+
- Libraries: cobra, aws-sdk-go-v2, google-cloud-go
- Distribution: Homebrew, apt, yum, winget
Cloud Tools:
- Frontend: React 18, TypeScript, Tailwind CSS
- Backend: Node.js 18, Express, TypeScript
- Database: PostgreSQL 15
- Container: Docker, Docker Compose
Desktop Tools:
- Framework: Electron 28
- Backend: Go (for system access)
- Distribution: DMG (macOS), MSI (Windows), AppImage (Linux)
# Scan AWS infrastructure
soc2-check --provider aws --region us-east-1 --output report.html
# Result: Compliance score 67/100
# - 2 Critical issues (Root MFA, CloudTrail)
# - 8 High issues (S3 encryption, IAM)
# - 10 Medium issues# Check MFA across all services
mfa-status --all --output mfa-report.csv
# Result: 96.8% coverage across 222 users
# - AWS: 89.4% (5 users missing MFA)
# - Okta: 98.7% (2 users missing MFA)
# - GitHub: 100% ✅# Find public S3/GCS/Azure buckets
public-bucket --provider all
# Result: Found 5 public buckets
# - 1 Critical (public write access)
# - 2 High (public read with data)
# - 2 Medium (public read, empty)# .github/workflows/compliance.yml
name: Compliance Check
on: [push, pull_request]
jobs:
compliance:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- name: Install LowerPlane CLI
run: |
curl -sSL https://get.lowerplane.com/install | bash
- name: Run Compliance Checks
run: |
compliance-ci --config .compliance.yml
- name: Upload Results
uses: actions/upload-artifact@v3
with:
name: compliance-report
path: compliance-report.html# Start PolicyHub
cd tools/cloud/policy-hub
docker-compose up -d
# Access at http://localhost:3001
# Create policies, track versions, manage approvals- Local Execution - No data leaves your environment
- Self-Hosted - Deploy on your own infrastructure
- Open Source - Audit the code yourself
- No Phone-Home - Zero telemetry by default
- ✅ SOC 2 Type I & II
- ✅ ISO 27001
- ✅ GDPR
- ✅ HIPAA
- ✅ PCI-DSS
- ✅ NIST CSF
- ✅ Custom frameworks
Cloud Providers: AWS, GCP, Azure, DigitalOcean, Linode
Identity: Okta, Azure AD, Google Workspace, Auth0, OneLogin
DevOps: GitHub, GitLab, BitBucket, Jenkins, CircleCI
Monitoring: CloudWatch, Stackdriver, DataDog, Splunk
More: Slack, Jira, PagerDuty, 1Password, and 50+ more
- Automated evidence collection
- Real-time monitoring
- Drift detection
- Scheduled scans
- Webhook notifications
- CLI Tools: Go 1.21+ (optional, pre-built binaries available)
- Cloud Tools: Docker 24.0+, Docker Compose 2.0+
- Desktop Tools: Node.js 18+ (for building from source)
# Add LowerPlane tap
brew tap lowerplane/tap
# Install CLI tools
brew install lowerplane-toolkit
# Install desktop apps
brew install --cask lowerplane-desktop
brew install --cask lowerplane-clipboard# Linux/macOS
curl -sSL https://get.lowerplane.com/install | bash
# Windows (PowerShell)
iwr -useb https://get.lowerplane.com/install.ps1 | iex# Debian/Ubuntu
wget -qO- https://apt.lowerplane.com/gpg.key | sudo apt-key add -
echo "deb https://apt.lowerplane.com stable main" | sudo tee /etc/apt/sources.list.d/lowerplane.list
sudo apt update && sudo apt install lowerplane-toolkit
# RHEL/CentOS
sudo yum-config-manager --add-repo https://yum.lowerplane.com/lowerplane.repo
sudo yum install lowerplane-toolkit
# Windows
winget install LowerPlane.ComplianceToolkit# Pull all cloud tools
docker pull lowerplane/policy-hub
docker pull lowerplane/access-review
docker pull lowerplane/vendor-risk
# Or use Docker Compose
git clone https://github.com/lowerplane/compliance-toolkit.git
cd compliance-toolkit
docker-compose up -d# Clone repository
git clone https://github.com/lowerplane/compliance-toolkit.git
cd compliance-toolkit
# Build CLI tools
make build-cli
# Build cloud tools
make build-cloud
# Build desktop tools
make build-desktop
# Install locally
make installProblem: You have a SOC 2 audit in 3 months and don't know where you stand.
Solution:
# Run comprehensive scan
soc2-check --provider aws,gcp --output pre-audit-report.html
# Review findings
open pre-audit-report.html
# Fix critical issues
public-bucket --auto-fix
mfa-status --all --enforce
# Track progress
compliance-score --framework soc2Problem: Your compliance drifts between annual audits.
Solution:
# Set up continuous monitoring
compliance-ci --continuous --interval 24h --webhook https://slack.com/...
# Automated evidence collection
evidence-cli --schedule daily --export lowerplane
# Real-time alerts
cloud-scanner --monitor --alert critical,highProblem: Quarterly access reviews take 40+ hours of manual work.
Solution:
# Deploy AccessReview tool
cd tools/cloud/access-review
docker-compose up -d
# Connect integrations (AWS, Google Workspace, Okta)
# Generate access reports automatically
# Email managers for review
# Track approvals and revocationsProblem: You need to vet 50+ vendors for security compliance.
Solution:
# Deploy VendorRisk tool
cd tools/cloud/vendor-risk
docker-compose up -d
# Send security questionnaires
# Collect SOC 2 reports
# Track certifications
# Generate risk scoresProblem: Security issues reach production.
Solution:
# .github/workflows/security.yml
- name: Run Compliance Checks
run: |
compliance-ci --fail-on critical,high
container-scan --image ${{ env.IMAGE }}
api-key-scanner --path .We love contributions! LowerPlane Compliance Toolkit is built by the community, for the community.
- 🐛 Report Bugs - Open an issue
- ✨ Request Features - Start a discussion
- 📝 Improve Docs - Documentation PRs always welcome
- 🔧 Submit PRs - See CONTRIBUTING.md
- ⭐ Star the Repo - Help us reach more people
- 💬 Join Community - Slack | Discord
# Fork and clone
git clone https://github.com/YOUR_USERNAME/compliance-toolkit.git
cd compliance-toolkit
# Install dependencies
make deps
# Run tests
make test
# Build everything
make build
# Run locally
make devSee CONTRIBUTING.md for detailed guidelines.
- v1.0.0 (Current) - Initial release with 50+ tools
- v1.1.0 (Q2 2025) - Additional integrations, improved UI
- v1.2.0 (Q3 2025) - Advanced reporting, AI-powered recommendations
- v2.0.0 (Q4 2025) - Multi-tenant support, compliance automation engine
- CLI tools for AWS/GCP/Azure
- Cloud tools (PolicyHub, AccessReview, VendorRisk)
- Desktop applications
- Docker deployment
- Kubernetes deployment
- Terraform modules
- Advanced reporting engine
- AI-powered risk assessment
- Mobile applications
- Slack/Teams bots
Used by 500+ companies to manage $200M+ in enterprise deals
While we can't name all our users (NDAs!), our toolkit is used by:
- 🚀 Startups - Getting SOC 2 compliant to close enterprise deals
- 🏢 Scale-ups - Maintaining compliance as they grow
- 🏭 Enterprises - Automating compliance across hundreds of systems
- 🎓 Educational Institutions - Teaching compliance best practices
- 🏛️ Government Agencies - Meeting NIST and FedRAMP requirements
Compliance shouldn't be locked behind enterprise paywalls.
We believe that:
- 🌍 Security is a right - Every company deserves good security
- 🔓 Transparency builds trust - Open source = auditable
- 🤝 Community drives innovation - Best ideas come from practitioners
- 📚 Knowledge should be shared - Help the next generation
- Website: https://lowerplane.com
- Documentation: https://docs.lowerplane.com
- Blog: https://lowerplane.com/blog
- Community: https://community.lowerplane.com
- Slack: https://lowerplane.com/slack
- Discord: https://lowerplane.com/discord
- Twitter: https://twitter.com/lowerplane
- LinkedIn: https://linkedin.com/company/lowerplane
LowerPlane Compliance Toolkit is open source software licensed under the MIT License.
MIT License
Copyright (c) 2025 LowerPlane, Inc.
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
Built with ❤️ by the LowerPlane team and contributors worldwide.
Special thanks to:
- Our amazing open source contributors
- The compliance and security community
- Companies who trusted us early
- Everyone who gave feedback and reported issues
- 🎯 Priority support
- 📞 Phone & video support
- 🏢 Custom integrations
- 📊 Training & onboarding
- 🔐 Security consulting
Contact: enterprise@lowerplane.com
⭐ If you find this project useful, please consider giving it a star! ⭐
Made with ❤️ by LowerPlane
- Project structure and folder organization
- All 33 CLI tools implementation with Go
- All 10 cloud tools with Express/TypeScript backends
- All 7 desktop applications with Electron
- PolicyHub React frontend
- Shared Go packages (logger, config, reporter, background)
- Docker Compose setup for all cloud tools
- Basic documentation for all tools
- .gitignore and development setup
- Makefile with build targets
- Integration testing
- CI/CD pipelines
- Cloud tool React frontends (except PolicyHub)
- Homebrew tap setup
- Package distributions (deb, rpm, msi)
- Documentation website
- Example configurations
- Video tutorials
- Kubernetes deployment
- Real cloud provider integrations (AWS/GCP/Azure SDKs)
compliance-toolkit/
├── .github/
│ ├── workflows/
│ │ ├── ci.yml # CI/CD pipeline
│ │ ├── release.yml # Release automation
│ │ ├── security.yml # Security scanning
│ │ └── docs.yml # Documentation deployment
│ ├── ISSUE_TEMPLATE/
│ │ ├── bug_report.md
│ │ ├── feature_request.md
│ │ └── question.md
│ ├── PULL_REQUEST_TEMPLATE.md
│ ├── CODEOWNERS
│ └── dependabot.yml
│
├── docs/
│ ├── assets/
│ │ ├── logo.png
│ │ ├── screenshots/
│ │ └── diagrams/
│ ├── frameworks/
│ │ ├── SOC2.md
│ │ ├── ISO27001.md
│ │ ├── GDPR.md
│ │ ├── HIPAA.md
│ │ └── NIST.md
│ ├── guides/
│ │ ├── getting-started.md
│ │ ├── deployment.md
│ │ ├── integrations.md
│ │ └── best-practices.md
│ ├── INSTALLATION.md
│ ├── QUICK_START.md
│ ├── CLI_TOOLS.md
│ ├── CLOUD_TOOLS.md
│ ├── DESKTOP_TOOLS.md
│ ├── ARCHITECTURE.md
│ ├── ARCHITECTURE_DEEP_DIVE.md
│ ├── API.md
│ ├── FAQ.md
│ ├── TROUBLESHOOTING.md
│ └── USERS.md
│
├── tools/
│ ├── cli/
│ │ ├── soc2-check/
│ │ │ ├── cmd/
│ │ │ │ └── soc2-check/
│ │ │ │ └── main.go
│ │ │ ├── pkg/
│ │ │ │ ├── scanner/
│ │ │ │ │ ├── aws.go
│ │ │ │ │ ├── gcp.go
│ │ │ │ │ └── azure.go
│ │ │ │ ├── checks/
│ │ │ │ │ ├── encryption.go
│ │ │ │ │ ├── access.go
│ │ │ │ │ └── logging.go
│ │ │ │ └── report/
│ │ │ │ └── report.go
│ │ │ ├── internal/
│ │ │ │ └── models/
│ │ │ ├── configs/
│ │ │ ├── go.mod
│ │ │ ├── go.sum
│ │ │ ├── README.md
│ │ │ ├── Makefile
│ │ │ └── Dockerfile
│ │ │
│ │ ├── mfa-status/
│ │ │ ├── cmd/
│ │ │ ├── pkg/
│ │ │ ├── internal/
│ │ │ ├── go.mod
│ │ │ ├── README.md
│ │ │ └── Makefile
│ │ │
│ │ ├── public-bucket/
│ │ │ ├── cmd/
│ │ │ ├── pkg/
│ │ │ ├── internal/
│ │ │ ├── go.mod
│ │ │ ├── README.md
│ │ │ └── Makefile
│ │ │
│ │ ├── compliance-ci/
│ │ ├── evidence-cli/
│ │ ├── password-policy/
│ │ ├── ssl-expiry/
│ │ ├── log-retention/
│ │ ├── training-status/
│ │ ├── email-security/
│ │ ├── access-last-used/
│ │ ├── admin-access/
│ │ ├── encrypt-check/
│ │ ├── backup-test/
│ │ ├── api-key-scanner/
│ │ ├── firewall-rules/
│ │ ├── patch-status/
│ │ ├── network-scan/
│ │ ├── gdpr-check/
│ │ ├── vendor-cert/
│ │ ├── policy-version/
│ │ ├── incident-time/
│ │ ├── db-encryption/
│ │ ├── container-scan/
│ │ ├── dns-security/
│ │ ├── session-timeout/
│ │ ├── data-classification/
│ │ ├── compliance-score/
│ │ ├── control-test/
│ │ ├── risk-calculator/
│ │ ├── audit-prep/
│ │ ├── evidence-hash/
│ │ └── audit-export/
│ │
│ ├── cloud/
│ │ ├── policy-hub/
│ │ │ ├── frontend/
│ │ │ │ ├── src/
│ │ │ │ │ ├── components/
│ │ │ │ │ ├── pages/
│ │ │ │ │ ├── hooks/
│ │ │ │ │ ├── utils/
│ │ │ │ │ ├── types/
│ │ │ │ │ ├── App.tsx
│ │ │ │ │ └── main.tsx
│ │ │ │ ├── public/
│ │ │ │ ├── package.json
│ │ │ │ ├── tsconfig.json
│ │ │ │ ├── vite.config.ts
│ │ │ │ └── tailwind.config.js
│ │ │ ├── backend/
│ │ │ │ ├── src/
│ │ │ │ │ ├── controllers/
│ │ │ │ │ ├── models/
│ │ │ │ │ ├── routes/
│ │ │ │ │ ├── middleware/
│ │ │ │ │ ├── services/
│ │ │ │ │ ├── utils/
│ │ │ │ │ └── server.ts
│ │ │ │ ├── migrations/
│ │ │ │ ├── seeds/
│ │ │ │ ├── package.json
│ │ │ │ ├── tsconfig.json
│ │ │ │ └── .env.example
│ │ │ ├── docker-compose.yml
│ │ │ ├── Dockerfile.frontend
│ │ │ ├── Dockerfile.backend
│ │ │ ├── README.md
│ │ │ └── Makefile
│ │ │
│ │ ├── access-review/
│ │ │ ├── frontend/
│ │ │ ├── backend/
│ │ │ ├── docker-compose.yml
│ │ │ └── README.md
│ │ │
│ │ ├── vendor-risk/
│ │ ├── cloud-scanner/
│ │ ├── framework-mapper/
│ │ ├── audit-trail/
│ │ ├── training-tracker/
│ │ ├── change-log/
│ │ ├── incident-response/
│ │ └── pentest-portal/
│ │
│ └── desktop/
│ ├── compliance-desktop/
│ │ ├── src/
│ │ │ ├── main/
│ │ │ │ ├── main.ts # Electron main process
│ │ │ │ ├── preload.ts # Preload scripts
│ │ │ │ └── ipc/ # IPC handlers
│ │ │ ├── renderer/
│ │ │ │ ├── components/
│ │ │ │ ├── pages/
│ │ │ │ ├── hooks/
│ │ │ │ ├── App.tsx
│ │ │ │ └── index.tsx
│ │ │ └── shared/
│ │ │ ├── types/
│ │ │ └── utils/
│ │ ├── assets/
│ │ ├── package.json
│ │ ├── electron-builder.yml
│ │ ├── tsconfig.json
│ │ └── README.md
│ │
│ ├── secure-clipboard/
│ ├── backup-verifier/
│ ├── encryption-checker/
│ ├── password-auditor/
│ ├── asset-inventory/
│ └── compliance-sync/
│
├── shared/
│ ├── go/
│ │ ├── auth/ # Shared authentication
│ │ ├── config/ # Configuration management
│ │ ├── logger/ # Logging utilities
│ │ ├── errors/ # Error handling
│ │ └── utils/ # Common utilities
│ ├── typescript/
│ │ ├── types/ # Shared TypeScript types
│ │ ├── utils/ # Shared utilities
│ │ ├── components/ # Shared React components
│ │ └── hooks/ # Shared React hooks
│ └── docker/
│ ├── postgres/
│ ├── nginx/
│ └── redis/
│
├── scripts/
│ ├── install.sh # Installation script
│ ├── install.ps1 # Windows installation
│ ├── build-cli.sh # Build all CLI tools
│ ├── build-cloud.sh # Build cloud tools
│ ├── build-desktop.sh # Build desktop tools
│ ├── test-all.sh # Run all tests
│ ├── release.sh # Create release
│ └── setup-dev.sh # Development setup
│
├── configs/
│ ├── soc2-controls.yaml # SOC 2 control definitions
│ ├── iso27001-controls.yaml # ISO 27001 controls
│ ├── gdpr-requirements.yaml # GDPR requirements
│ └── integrations.yaml # Integration configs
│
├── deployments/
│ ├── kubernetes/
│ │ ├── policy-hub/
│ │ ├── access-review/
│ │ └── vendor-risk/
│ ├── terraform/
│ │ ├── aws/
│ │ ├── gcp/
│ │ └── azure/
│ └── ansible/
│ └── playbooks/
│
├── tests/
│ ├── cli/
│ │ ├── soc2-check_test.go
│ │ ├── mfa-status_test.go
│ │ └── public-bucket_test.go
│ ├── cloud/
│ │ ├── policy-hub.test.ts
│ │ └── access-review.test.ts
│ ├── integration/
│ │ └── e2e/
│ └── fixtures/
│ ├── aws-mocks/
│ └── test-data/
│
├── homebrew/
│ └── Formula/
│ ├── lowerplane-toolkit.rb
│ ├── soc2-check.rb
│ └── mfa-status.rb
│
├── packages/
│ ├── deb/
│ │ └── control
│ ├── rpm/
│ │ └── spec
│ └── msi/
│ └── config.xml
│
├── .gitignore
├── .gitattributes
├── .editorconfig
├── .dockerignore
├── README.md
├── LICENSE
├── CONTRIBUTING.md
├── CODE_OF_CONDUCT.md
├── SECURITY.md
├── CHANGELOG.md
├── ROADMAP.md
├── Makefile
├── docker-compose.yml # Start all cloud tools
├── docker-compose.dev.yml # Development setup
└── go.work # Go workspace file
# Contributing to LowerPlane Compliance Toolkit
Thank you for your interest in contributing! This document provides guidelines and instructions.
## Code of Conduct
Please read and follow our [Code of Conduct](CODE_OF_CONDUCT.md).
## How to Contribute
### Reporting Bugs
- Use GitHub Issues
- Include reproduction steps
- Provide system information
### Feature Requests
- Start a GitHub Discussion
- Describe the use case
- Explain the value
### Pull Requests
1. Fork the repository
2. Create a feature branch
3. Make your changes
4. Add tests
5. Submit a PR
## Development Setup
See [DEVELOPMENT.md](docs/DEVELOPMENT.md)
## Coding Standards
- **Go**: Follow [Effective Go](https://golang.org/doc/effective_go)
- **TypeScript**: Use ESLint + Prettier
- **Commits**: Use [Conventional Commits](https://www.conventionalcommits.org/)
## License
By contributing, you agree that your contributions will be licensed under the MIT License.# Security Policy
## Reporting a Vulnerability
**Please do not report security vulnerabilities through public GitHub issues.**
Instead, email: security@lowerplane.com
Include:
- Description of the vulnerability
- Steps to reproduce
- Potential impact
- Suggested fix (if any)
## Response Timeline
- Acknowledgment: Within 24 hours
- Initial assessment: Within 72 hours
- Fix timeline: Depends on severity
## Supported Versions
| Version | Supported |
| ------- | ------------------ |
| 1.x.x | :white_check_mark: |
| < 1.0 | :x: |# Contributor Covenant Code of Conduct
## Our Pledge
We pledge to make participation in our community a harassment-free experience for everyone.
## Our Standards
Examples of behavior that contributes to a positive environment:
- Using welcoming and inclusive language
- Being respectful of differing viewpoints
- Gracefully accepting constructive criticism
- Focusing on what is best for the community
## Enforcement
Instances of abusive behavior may be reported to conduct@lowerplane.com..PHONY: help install build test clean deps
help: ## Show this help
@grep -E '^[a-zA-Z_-]+:.*?## .*$$' $(MAKEFILE_LIST) | sort | awk 'BEGIN {FS = ":.*?## "}; {printf "\033[36m%-30s\033[0m %s\n", $$1, $$2}'
deps: ## Install dependencies
@echo "Installing Go dependencies..."
@go mod download
@echo "Installing Node.js dependencies..."
@cd tools/cloud && npm install
build-cli: ## Build all CLI tools
@echo "Building CLI tools..."
@./scripts/build-cli.sh
build-cloud: ## Build cloud tools
@echo "Building cloud tools..."
@./scripts/build-cloud.sh
build-desktop: ## Build desktop tools
@echo "Building desktop tools..."
@./scripts/build-desktop.sh
build: build-cli build-cloud build-desktop ## Build everything
test: ## Run all tests
@echo "Running tests..."
@./scripts/test-all.sh
install: ## Install all tools locally
@echo "Installing..."
@./scripts/install.sh
clean: ## Clean build artifacts
@echo "Cleaning..."
@rm -rf dist/
@rm -rf build/
@go clean -cache
dev: ## Start development environment
@docker-compose -f docker-compose.dev.yml up
release: ## Create a release
@./scripts/release.sh