reglet

Reglet

Compliance as Code. Secure by Design.

Reglet is a compliance and infrastructure validation engine that runs security checks in isolated WebAssembly sandboxes. Define policies as code, validate systems and services, and get standardized audit output ready for SOC2, ISO27001, and more.

Quick Start

# brew not available for pre-release
brew install reglet-dev/tap/reglet           # macOS/Linux
# Install (choose one)
docker pull ghcr.io/reglet-dev/reglet:v0.2.0-alpha # Docker
curl -sSL https://raw.githubusercontent.com/reglet-dev/reglet/main/scripts/install.sh | sh  # Script

# Get an example profile
curl -fsSL https://raw.githubusercontent.com/reglet-dev/reglet/main/docs/examples/01-quickstart.yaml > quickstart.yaml

# Run it
reglet check quickstart.yaml

# Or with Docker
docker run --rm -v $(pwd)/quickstart.yaml:/quickstart.yaml \
  ghcr.io/reglet-dev/reglet:v0.2.0-alpha check /quickstart.yaml

Usage

# Output formats
reglet check profile.yaml --format=json
reglet check profile.yaml --format=sarif -o results.sarif

# Quiet mode for CI/scripts
reglet check profile.yaml --quiet

# Debug mode
reglet check profile.yaml --log-level=debug

# Filter controls
reglet check profile.yaml --tags security
reglet check profile.yaml --severity critical,high

Features

• Declarative Profiles - Define validation rules in simple, versioned YAML
• Parallel Execution - Optimized for CI/CD with concurrent execution of independent controls
• Standardized Output - JSON, YAML, JUnit, SARIF - ready for compliance platforms or OSCAL integration (coming soon)
• Secure Sandbox - All validation logic runs inside a CGO-free WebAssembly runtime (wazero)
• Capability-Based Security - Plugins can only access files, networks, or environment variables if explicitly allowed
• Secret Management - Resolve secrets from environment variables, files, or local config with {{ secret "name" }} syntax
• Automatic Redaction - Sensitive data (secrets, tokens) is automatically detected and redacted before reporting

What Can It Validate?

See examples/ for working profiles.

Security Model

Reglet uses capability-based security - plugins can only access what's explicitly granted:

• Automatic Discovery: Permissions are extracted from your profile (e.g., path: /etc/passwd grants read to only that file)
• No Broad Access: Unlike scripts with full host access, plugins are sandboxed
• Security Levels: Control how Reglet handles risky patterns:
  • strict - Deny broad capabilities automatically
  • standard - Warn and prompt before granting (default)
  • permissive - Auto-grant for trusted environments

# ~/.reglet/config.yaml
security:
  level: standard  # strict, standard, or permissive

See docs/security.md for the full security architecture.

Secret Management

Reglet supports secure secret resolution via {{ secret "name" }} syntax in profiles:

# ~/.reglet/config.yaml
sensitive_data:
  secrets:
    # Environment variable mapping
    env:
      api_token: API_TOKEN        # {{ secret "api_token" }} resolves from $API_TOKEN
      db_password: DATABASE_PASS

    # File-based secrets (admin-controlled paths)
    files:
      ssh_key: /etc/reglet/secrets/ssh.key

    # Local secrets (development only - never commit!)
    local:
      dev_token: "local-dev-value"

Secrets are automatically:

• Tracked and redacted from all output (evidence, logs, errors)
• Protected in memory with zeroing when possible
• Never logged in plaintext

Example usage in a profile:

controls:
  items:
    - id: api-health
      name: API health check with authentication
      observations:
        - plugin: http
          config:
            url: https://api.example.com/health
            headers:
              Authorization: "Bearer {{ secret \"api_token\" }}"
          expect: |
            data.status_code == 200

Example Profile

profile:
  name: SSH Security
  description: Check SSH configuration
  version: 1.0.0

plugins:
  - file

controls:
  items:
    - id: sshd-config
      name: SSH password authentication disabled
      observations:
        - plugin: file
          config:
            path: /etc/ssh/sshd_config
          expect: |
            data.content.contains("PasswordAuthentication no")

Installation

Homebrew (macOS/Linux)

Note: pre-release is not available via Homebrew

brew install reglet-dev/tap/reglet
reglet version

Docker

# Pull image
docker pull ghcr.io/reglet-dev/reglet:v0.2.0-alpha

# Quick version check
docker run --rm ghcr.io/reglet-dev/reglet:v0.2.0-alpha version

# Run with profile from host
docker run --rm -v $(pwd)/profile.yaml:/profile.yaml \
  ghcr.io/reglet-dev/reglet:latest check /profile.yaml

# Try built-in examples
docker run --rm ghcr.io/reglet-dev/reglet:latest \
  check /home/reglet/docs/examples/01-quickstart.yaml

Install Script (Linux/macOS)

curl -sSL https://raw.githubusercontent.com/reglet-dev/reglet/main/scripts/install.sh | sh

Manual Download

Download the appropriate archive for your platform from the releases page, extract it, and move the binary to your PATH:

# Linux/macOS
tar -xzf reglet-*.tar.gz
sudo mv reglet /usr/local/bin/
reglet version

# Windows (PowerShell)
Expand-Archive reglet-*.zip
Move-Item reglet.exe C:\Windows\System32\
reglet version

From Source

Requires Go 1.25+:

git clone https://github.com/reglet-dev/reglet.git
cd reglet
make build
./bin/reglet check docs/examples/01-quickstart.yaml

Examples

• 01-quickstart.yaml - Basic system security checks
• 02-ssh-hardening.yaml - SSH hardening (SOC2 CC6.1)
• 03-web-security.yaml - HTTP/HTTPS validation
• 04-dns-validation.yaml - DNS resolution and records
• 05-tcp-connectivity.yaml - TCP ports and TLS testing
• 06-command-checks.yaml - Command execution and output validation
• 07-vars-and-defaults.yaml - Variables and control defaults

Status: Alpha (v0.2.0-alpha)

Reglet is in active development. Core features work, but expect breaking changes before 1.0.

Roadmap

v0.2.0-alpha (Current)

• Core execution engine with parallel execution
• Plugins: File, HTTP, DNS, TCP, Command, SMTP
• Capability system with profile-based discovery
• Configurable security levels (strict/standard/permissive)
• Automatic secret redaction
• Output formatters (Table, JSON, YAML, JUnit, SARIF)
• Binary releases for Linux/macOS/Windows (amd64/arm64)
• Docker images (GHCR multi-arch)
• Homebrew tap
• Automated releases with goreleaser

v0.3.0-alpha (In Development)

• Profile inheritance (extends: field)
• Lockfile for reproducible plugin versions (reglet.lock)
• Retry and backoff for resilient execution
• Secret management (env/files/local resolution)
• Evidence artifacts and size limits (size, count)
• Global timeout

v0.4.0-alpha

• Tag and severity filtering

v0.5.0-alpha

• OCI-based plugin registry (version pinning, aliases)

v0.6.0-alpha

• OSCAL output

v1.0

• Cloud provider plugins (AWS, GCP, Azure)
• Compliance packs (SOC2, ISO27001, FedRAMP)
• CI/CD integrations (GitHub Actions, GitLab CI)
• Plugin SDK documentation

Community

We welcome contributions! Please see our Contributing Guide and Code of Conduct.

• Issues: GitHub Issues
• Discussions: GitHub Discussions

License

Apache-2.0 - See LICENSE