slsa

A Git-native dependency admission controller. Evaluates trust signals on every dependency change and blocks commits or builds when packages fail your team's policy. Pre-commit hook + CI gate with built-in approval workflow.

Reproducible Chrome extension security auditing CLI with MV2/MV3 comparison, threat intelligence, safe CRX quarantine, SBOMs, and isolated dynamic analysis.

Software build assurance for coding agents - enforced red-first TDD, self-tested gates, calibrated independent verification, and commit-bound evidence.

A Lifesaver learning app for bronze proficiency level

Secure Software Delivery Architecture (SSDA) handbook — a platform engineer's guide to software supply chain security, from Git commit to running workload. Covers source trust, CI provenance, SBOMs, artifact signing, attestation, GitOps, workload identity, runtime security, and platform security.

Your git history says who committed it. It says nothing about what wrote it. Line-level AI authorship in git notes, attestable to somebody who does not trust you. Declarations only, never inference.

Easily publish npm packages with provenance (SLSA attestations) and verify them.

Single-file zero-dep Node ESM CLI + library for CloudCDN. Agent-first: MCP stdio server, machine-readable `stratos schema`, NDJSON streaming, stable typed errors. ~35 commands across the full control plane. SLSA L3, Cosign keyless, 100% test coverage.

See what an install script actually does before you approve it: behavioral analysis, binding.gyp inspection and resolved provenance identity for npm 12 allowScripts, pnpm allowBuilds, yarn and bun

Secure CI/CD pipeline with SLSA L3 provenance, Sigstore/Cosign signing, and OPA policy-as-code

Audit repositories for build provenance, SLSA attestations, trusted publishing, signing, verification commands, and release supply-chain trust signals.

Robot Shop with a signed, attested, policy-enforced CI/CD supply chain on EKS

Founder and CEO, SZL Holdings - governed AI infrastructure with inspectable source, runtime state, receipts, and proof boundaries.

Documentation site (Astro Starlight) for attested-delivery: attested-workflow practices, specs, and ADRs.

Correlate container vulnerabilities with deployed workloads and verified build provenance.

Lab repository demonstrates how to create provenance without using the npm CLI and publish a package to npmjs.com with an attached provenance file (not generated by the npm CLI)

Continuously refreshed, scanned, and attested builds of stable upstream container images.

Portable, fail-closed assurance record primitives for immutable software evidence.

78 Cedar policies and 369 rules governing AI coding agents. Every rule traces to a real incident, published CVE, or compliance framework requirement (SOC 2, NIST, ISO 27001, EU AI Act, OWASP).

Offline content-addressed proof that independent build receipts reproduced byte-identical specified artifacts