GOVERNANCE WORKSPACE

From policy.
To proof.

Inspect your code against the controls that matter.
Find the gaps. Keep the evidence. Decide what comes next.

01 / Project source

What are we inspecting?

Explore source selection. No files leave your browser; the report uses a bundled sample.

↑ Choose a file locallyZIP archive · up to 50 MBSelect a file from your device Public repositoryChoose a ZIP or a repository URL, not both.

02 / Where your project operates

Give your scan context.

Select deployment regions and your assessed risk tier. Risk classification is your compliance decision; the scanner does not infer it.

Sector:

Deployment regions and risk tier:

	Deployed here	Risk tier
EU
US-Colorado
US-NYC
US-Illinois
UAE-Dubai

Collects/uses biometric data Used in hiring/employment decisions Credentials must come from Vault/AWS Secrets Manager/Azure Key Vault

03 / Extend this scan

Review. Then run.

Add custom Semgrep or Rego checks Optional

Ad-hoc checks for just this scan — not part of the audited registry (no proof fixtures, no jurisdiction mapping, shown separately in the report below).

Custom Semgrep rule (YAML, needs a top-level "rules:" list): Custom Conftest/Rego policy (needs a "package" declaration):

Ready to inspect?

Your source is inspected, not executed.

From policy.To proof.

What are we inspecting?

Give your scan context.

Review. Then run.

From policy.
To proof.