Continuous Monitoring
Show our work. Every claim links to evidence.
Continuous monitoring is the spine of the trust posture. Most trust portals assert it; we show the cadence, the tools, and the live results.
Layered scan coverage
- Aikido — continuous on every push
SaaS scanner integrated with the repo. Every lockfile change triggers a scan; SAST findings (SQL injection, template literals, etc.) appear inline in PR review.
- GitHub Actions deep audit — daily 09:00 UTC
grype + pip-audit + cargo-audit + bun pm audit across all lockfiles. Posts a structured summary to the security audit channel.
Workflow source - Release security gate — every tag
grype --only-fixed runs against 9 lockfile targets (root + portal + marketplace + licensing dashboard + 4 Python projects + 2 Cargo projects) before any release tag is published. Documented in CLAUDE.md.
Release security gate - Pre-commit hooks — every commit
Husky pre-commit runs typecheck + lint-staged (ESLint + Prettier for TS/TSX, Ruff for Python). Catches typing errors and policy violations before they merge.
What the scans cover
- Dependency vulnerabilities
All four package managers — npm (bun.lock), pypi (uv.lock), cargo (Cargo.lock), and bun's audit endpoint. Cross-checked across grype's NVD feed and Aikido's curated database.
- License compliance
CycloneDX SBOM enrichment tracks license per component. Suppression-report.md documents accepted exceptions with audit trail.
SBOM - SAST (static application security testing)
Aikido SAST. Findings published per release in CHANGELOG.md under the Security heading with issue IDs.
- Build provenance
SHA-256 checksums per platform, generated in CI, published with every release.
Per-release checksums
What you can verify yourself
- Live vulnerability rollup
Open critical / high / medium / low CVE counts per product, refreshed daily and per-release.
Vulnerability rollup - Per-release SBOM
Download the CycloneDX JSON or HTML report for any release. 2,672 components currently tracked.
SBOM index - Per-release security notes
CHANGELOG entries call out CVE patches, dependency upgrades, and SAST resolutions per version.
Release notes