Policy meets code.
With clear limits.
REDZOHU Governance Scanner is a personal engineering and portfolio project. I built it to explore governance tooling, practice product development, and learn by creating my own workflows instead of relying only on hosted third-party products. It is not offered as a commercial compliance service.
What the scanner actually does
The local application accepts a ZIP archive or a supported public Git repository. You specify deployment regions, sector and risk tiers. It compares source files and project metadata against a curated control registry and produces a report grouped by jurisdiction.
What a result means
PASS means the applicable configured check passed for this input. It does not mean the project complies with every law or has no vulnerabilities. Findings can include false positives and false negatives. Missing or outdated rules can leave gaps. Some requirements cannot be assessed from source code.
Public demo versus local scanner
The public frontend demo uses a bundled sample fixture. It does not upload, retain or scan your chosen source. Form choices let you explore the workflow, but do not alter the sample findings. The local Flask application runs the real policy engines and stores reports locally. Those reports can contain source references or sensitive findings; access and retention are the operator's responsibility.
Scope and limitations
- Selected controls reference EU, US state/local and UAE-Dubai jurisdictions. Coverage is partial, not exhaustive; references may become outdated.
- No legal advice, regulatory approval, compliance certification, independent assurance or production-readiness guarantee is provided.
- Do not use this project as the sole basis for legal, security, employment or other consequential decisions.
- Use only code you own or are authorized to inspect. Do not provide credentials, personal data, confidential source or third-party secrets to the public demo.
- Custom rules in the local app are ad-hoc checks. They are separate from the audited registry and do not have the same proof-fixture coverage.
- This project builds on open-source engines; it does not claim to replace or independently recreate Semgrep, OPA or Conftest. No affiliation or endorsement is implied.
Why I built it
To make my skills and interests tangible: a working interface, reusable policies, testable checks and a transparent evidence trail. This is an evolving experiment that welcomes learning and careful feedback—not a promise of enterprise completeness.