README
¶
Openlane is one of the few, truly open-source compliance automation platforms - giving you a system of record for your compliance program including the people, systems, and vendors in scope; the policies and controls that govern them; and the evidence that proves it, and all with the automation to keep it current. This repository contains the core server and orchestration services behind the Openlane cloud service.
Features
The platform is organized into a handful of areas that build on each other:
- Compliance management: policies, controls, evidence, and programs, with editors, approvals, comments, and full history on every object
- Frameworks and standards: importable control sets for SOC 2, ISO 27001, NIST 800-53, and more; one control can satisfy requirements across multiple frameworks
- Registry: automatically import your personnel and contractor lists from your directory, entities / vendors from your CRM, assets from your CMDB or spreadsheets, define platforms, vendor / 3d party contacts, and more
- Exposure: automated domain scanning, vulnerability integrations with GitHub, AWS Security Hub, and GCP Security Command Center (and more to come!) with remediation tracking to document fixes and update your risks
- Automation: integrate with the tools you already use like Google Drive, Github, Entra ID, AWS, GCP (and more!) with configurable workflows and approvals, email campaigns for bulk outreach, questionnaires and assessments for your vendors or employees, and task assignment with reminders and escalation
- Trust Center: a customizable, branded portal on your own domain publishing certifications, security documents, and subprocessors - reduce friction pre-sales and give your prospects and vendors one-stop shopping (check out ours)
- Organization settings: your tenant, your team, your data, with granular RBAC, billing, and the custom data that shapes how objects are classified
- Integrations and security: multiple authentication methods, organization-wide SSO, 2FA enforcement, auditor roles and views, all available with any of our modules so you're never paywalled for basic security measures
On the roadmap:
- Automated evidence collection and checks + tests libraries
- Internal training programs / campaigns
- Additional integrations with ticketing systems, documentation repositories, directories, security scanners
- Vendor Risk Scoring + TPRM modules
- Additional OSCAL support
Getting Started
The fastest way to use Openlane is signing up for the cloud service; free for the first 30 days, no credit card required. We built our product on the idea you should only pay for what you use, so no "tier" pricing - you can buy just the modules your team needs, and we have multiple partner, referral, and startup programs. Reach out if you aren't sure: info@theopenlane.io
Run It Yourself
With Go, brew, Task, and Docker installed:
task install:all
task run-dev
The Getting Started guide covers the full path: tooling and IDE setup, configuration, running the stack, creating a test user, CLI authentication, and querying the API. We're working to have published helm charts and other supported methods of deployment (and adoption + contribution from the community help drive that), but until then, you can find all required container images published to the GitHub container registry (see Operations) and published artifacts on the releases page of this repo.
Development
The Openlane founders have taken care to build our stack using other open-source tools and technologies so you don't need a dozen SaaS subscriptions to be able to run it; we used technologies like PostgreSQL, Redis, S3-compatible object storage (so you can leverage projects like Rook, Minio), ent, gqlgen, and OpenFGA, among many others.
The developer documentation covers the day-to-day workflows:
- Schema and codegen: creating schemas, code generation, and database migrations
- Architecture: request lifecycle, the workflows engine, and the multi-module repo structure
- Security: authentication, API tokens, and the authorization model
- Operations: configuration, secrets, and deployment; the full parameter list lives in the configuration reference
Security
Please do not file GitHub issues or post on our public forum for security vulnerabilities, as they are public!
Openlane takes security issues very seriously. If you have any concerns about Openlane or believe you have uncovered a vulnerability, please get in touch via the e-mail address security@theopenlane.io. In the message, try to provide a description of the issue and ideally a way of reproducing it. See security policy for more details.
Licensing
This repository contains open source software that comprises the Openlane stack which is open source software under Apache 2.0. Openlane's SaaS / Cloud Services are products produced from this open source software exclusively by theopenlane, Inc. This product is produced under our published commercial terms (which are subject to change). Any logos or trademarks in our repositories in theopenlane organization are not covered under the Apache License and are trademarks of theopenlane, Inc.
Others are allowed to make their own distribution of this software or include this software in other commercial offerings, but cannot use any of the Openlane logos, trademarks, cloud services, etc.
Contributing
See the contributing guide for how to get involved. If our code or projects have helped you, or you want to support the work, we appreciate sponsorship on our GitHub project at any level.
Documentation
Source Files
Directories
¶
| Path | Synopsis |
|---|---|
|
cli
module
|
|
|
Package cmd is our cobra cli implementation
|
Package cmd is our cobra cli implementation |
|
catalog
command
|
|
|
common
module
|
|
|
Package config holds configuration stuff to configure the things
|
Package config holds configuration stuff to configure the things |
|
Package db provides an embedded filesystem containing all the database migrations
|
Package db provides an embedded filesystem containing all the database migrations |
|
fga
|
|
|
internal
|
|
|
consts
Package consts contains constant values used throughout the application but are not configurable
|
Package consts contains constant values used throughout the application but are not configurable |
|
controls
Package controls provides functions for working with controls and subcontrols, including cloning and updating controls based on a standard set of controls.
|
Package controls provides functions for working with controls and subcontrols, including cloning and updating controls based on a standard set of controls. |
|
ent/csvgenerated
Code generated by entx CSV generator.
|
Code generated by entx CSV generator. |
|
ent/entconfig
Package entconfig holds configuration stuff for the ent server
|
Package entconfig holds configuration stuff for the ent server |
|
ent/generate
command
|
|
|
ent/generated
Code generated by entfga, DO NOT EDIT.
|
Code generated by entfga, DO NOT EDIT. |
|
ent/historyschema
Code generated by entx.history, DO NOT EDIT.
|
Code generated by entx.history, DO NOT EDIT. |
|
ent/hooks
Package hooks is middleware to alter the graphql mutation
|
Package hooks is middleware to alter the graphql mutation |
|
ent/interceptors
Package interceptors is middleware to alter the graphql query
|
Package interceptors is middleware to alter the graphql query |
|
ent/mixin
Package mixin contains the mixin package
|
Package mixin contains the mixin package |
|
ent/privacy/rule
Package rule contains policy rules
|
Package rule contains policy rules |
|
ent/privacy/token
Package token provides policy wrappers / getters for queries and mutations during password reset, sign-up
|
Package token provides policy wrappers / getters for queries and mutations during password reset, sign-up |
|
ent/privacy/utils
Package utils is a helper for working with ent policies
|
Package utils is a helper for working with ent policies |
|
ent/schema
Package schema contains the ent schema
|
Package schema contains the ent schema |
|
ent/workflowgenerated
Code generated by ent.
|
Code generated by ent. |
|
entdb
Package entdb extends the ent db library and satisfies matt's needs for consistency
|
Package entdb extends the ent db library and satisfies matt's needs for consistency |
|
entitlements
Package entitlements provides internal functionality for managing entitlemnets via combinations of pkg/entitlements and pkg/catalog
|
Package entitlements provides internal functionality for managing entitlemnets via combinations of pkg/entitlements and pkg/catalog |
|
entitlements/entmapping
Package entmapping provides some builders to assist in the type mapping between Stripe + the external generic definitions in pkg/catalog and pkg/entitlements and the internal ent generated types not intended for external use, but rather as a helper for the Openlane core application
|
Package entmapping provides some builders to assist in the type mapping between Stripe + the external generic definitions in pkg/catalog and pkg/entitlements and the internal ent generated types not intended for external use, but rather as a helper for the Openlane core application |
|
entitlements/features
code generated by local feature mapping, DO NOT EDIT.
|
code generated by local feature mapping, DO NOT EDIT. |
|
graphapi
Package graphapi is the graph api package
|
Package graphapi is the graph api package |
|
graphapi/common
Package common contains common utilities and types for the GraphQL API.
|
Package common contains common utilities and types for the GraphQL API. |
|
graphapi/directives
Package directives contains the implementations for the custom GraphQL directives used in the schema as well as an entc extension to modify the generated schema to add the directives to the appropriate fields.
|
Package directives contains the implementations for the custom GraphQL directives used in the schema as well as an entc extension to modify the generated schema to add the directives to the appropriate fields. |
|
graphapi/generate
command
|
|
|
graphapi/gqlerrors
Package gqlerrors is a wrapper to define custom errors for the GraphQL server
|
Package gqlerrors is a wrapper to define custom errors for the GraphQL server |
|
httpserve/authmanager
Package authmanager provides the authentication manager for the server to handle session issuance and validation
|
Package authmanager provides the authentication manager for the server to handle session issuance and validation |
|
httpserve/config
Package config holds the echo server configuration utilities
|
Package config holds the echo server configuration utilities |
|
httpserve/handlers
Package handlers contains custom handler functions
|
Package handlers contains custom handler functions |
|
httpserve/route
Package route will hold the routes and route groups
|
Package route will hold the routes and route groups |
|
httpserve/server
Package server contains the server functions
|
Package server contains the server functions |
|
httpserve/serveropts
Package serveropts contains an echo server options wrapper
|
Package serveropts contains an echo server options wrapper |
|
httpserve/specs
Package specs contains OpenAPI specifications that are merged into the main API spec The scim.yaml file contains the SCIM 2.0 OpenAPI specification which is automatically loaded and merged into the main OpenAPI specification during server startup The openlane.openapi.json file contains the fully composed OpenAPI specification that is served from /api-docs and kept in source control for linting and diffing
|
Package specs contains OpenAPI specifications that are merged into the main API spec The scim.yaml file contains the SCIM 2.0 OpenAPI specification which is automatically loaded and merged into the main OpenAPI specification during server startup The openlane.openapi.json file contains the fully composed OpenAPI specification that is served from /api-docs and kept in source control for linting and diffing |
|
httpserve/specs/generate
command
|
|
|
integrations/auth
Package auth provides shared authentication helpers and protocol types for integration auth flows
|
Package auth provides shared authentication helpers and protocol types for integration auth flows |
|
integrations/cli/config
Package config handles CLI configuration loading for the integrations CLI: env vars, config file, and flags merged into a single koanf namespace, plus the typed structs that subcommands read via Unmarshal.
|
Package config handles CLI configuration loading for the integrations CLI: env vars, config file, and flags merged into a single koanf namespace, plus the typed structs that subcommands read via Unmarshal. |
|
integrations/cli/openlane
Package openlane wraps the Openlane API client for use inside the integrations CLI.
|
Package openlane wraps the Openlane API client for use inside the integrations CLI. |
|
integrations/definitions/authentik
Package authentik provides an integration definition for Authentik (https://goauthentik.io), an open-source identity provider designed for self-hosted and on-premise deployments.
|
Package authentik provides an integration definition for Authentik (https://goauthentik.io), an open-source identity provider designed for self-hosted and on-premise deployments. |
|
integrations/definitions/awssecurityhub
Package awssecurityhub defines the consolidated AWS Security Hub, AWS IAM, and AWS Config integration definition.
|
Package awssecurityhub defines the consolidated AWS Security Hub, AWS IAM, and AWS Config integration definition. |
|
integrations/definitions/azureentraid
Package azureentraid provides the Azure Entra ID integration definition for integrations
|
Package azureentraid provides the Azure Entra ID integration definition for integrations |
|
integrations/definitions/azuresecuritycenter
Package azuresecuritycenter provides the Azure Security Center integration definition for integrations
|
Package azuresecuritycenter provides the Azure Security Center integration definition for integrations |
|
integrations/definitions/catalog
Package catalog exposes the built-in reference definition builders for integrations
|
Package catalog exposes the built-in reference definition builders for integrations |
|
integrations/definitions/cloudflare
Package cloudflare provides the Cloudflare integration definition for integrations
|
Package cloudflare provides the Cloudflare integration definition for integrations |
|
integrations/definitions/email
Package email provides the email integration definition for the integrations framework.
|
Package email provides the email integration definition for the integrations framework. |
|
integrations/definitions/email/themes
Package themes provides embedded email layout themes for the email integration
|
Package themes provides embedded email layout themes for the email integration |
|
integrations/definitions/gcpscc
Package gcpscc provides the GCP Security Command Center integration definition for integrations
|
Package gcpscc provides the GCP Security Command Center integration definition for integrations |
|
integrations/definitions/githubapp
Package githubapp defines the GitHub App reference definition for integrations
|
Package githubapp defines the GitHub App reference definition for integrations |
|
integrations/definitions/googledrive
Package googledrive provides the Google Drive integration definition for live document retrieval
|
Package googledrive provides the Google Drive integration definition for live document retrieval |
|
integrations/definitions/googleworkspace
Package googleworkspace provides the Google Workspace integration definition for integrations
|
Package googleworkspace provides the Google Workspace integration definition for integrations |
|
integrations/definitions/keycloak
Package keycloak provides an integration definition for Keycloak (https://www.keycloak.org), an open-source identity and access management solution designed for self-hosted and on-premise deployments.
|
Package keycloak provides an integration definition for Keycloak (https://www.keycloak.org), an open-source identity and access management solution designed for self-hosted and on-premise deployments. |
|
integrations/definitions/microsoftteams
Package microsoftteams provides the Microsoft Teams integration definition for integrations
|
Package microsoftteams provides the Microsoft Teams integration definition for integrations |
|
integrations/definitions/oidclocal
Package oidclocal provides a Dex-backed local OIDC integration definition for development testing
|
Package oidclocal provides a Dex-backed local OIDC integration definition for development testing |
|
integrations/definitions/okta
Package okta provides the Okta integration definition for integrations
|
Package okta provides the Okta integration definition for integrations |
|
integrations/definitions/onedrive
Package onedrive provides the Microsoft OneDrive integration definition for document management
|
Package onedrive provides the Microsoft OneDrive integration definition for document management |
|
integrations/definitions/scim
Package scim defines the SCIM reference definition for integrations
|
Package scim defines the SCIM reference definition for integrations |
|
integrations/definitions/slack
Package slack provides the Slack integration definition for integrations
|
Package slack provides the Slack integration definition for integrations |
|
integrations/definitions/system
Package system provides the internal system definition hosting scheduled runtime sweeps for organization lifecycle
|
Package system provides the internal system definition hosting scheduled runtime sweeps for organization lifecycle |
|
integrations/definitions/tailscale
Package tailscale provides the Tailscale integration definition for integrations
|
Package tailscale provides the Tailscale integration definition for integrations |
|
integrations/mappingtest
Package mappingtest provides shared test helpers for integration mapping tests.
|
Package mappingtest provides shared test helpers for integration mapping tests. |
|
integrations/observability
Package observability provides structured logging helpers for the integrations subsystem.
|
Package observability provides structured logging helpers for the integrations subsystem. |
|
integrations/operations
Package operations dispatches and executes definition-scoped operations for integrations
|
Package operations dispatches and executes definition-scoped operations for integrations |
|
integrations/providerkit
Package providerkit provides shared helpers used by integration definition implementations which assist in building consistent and robust integrations while reducing boilerplate.
|
Package providerkit provides shared helpers used by integration definition implementations which assist in building consistent and robust integrations while reducing boilerplate. |
|
integrations/registry
Package registry stores definition registrations for the greenfield integration runtime
|
Package registry stores definition registrations for the greenfield integration runtime |
|
integrations/runtime
Package runtime wires the integrations services into one executable runtime
|
Package runtime wires the integrations services into one executable runtime |
|
integrations/templatekit
Package templatekit provides shared template resolution and payload merging for integration operations
|
Package templatekit provides shared template resolution and payload merging for integration operations |
|
integrations/types
Package types defines the greenfield integration definition and registry contracts
|
Package types defines the greenfield integration definition and registry contracts |
|
keymaker
Package keymaker orchestrates OAuth/OIDC activation flows for integrations
|
Package keymaker orchestrates OAuth/OIDC activation flows for integrations |
|
keystore
Package keystore manages installation-scoped credential persistence and pooled client initialization for integrations.
|
Package keystore manages installation-scoped credential persistence and pooled client initialization for integrations. |
|
mutations
Package mutations provides shared helpers for extracting, normalizing, and cloning mutation field change data across eventing and workflow trigger contexts.
|
Package mutations provides shared helpers for extracting, normalizing, and cloning mutation field change data across eventing and workflow trigger contexts. |
|
objects
Package objects provides storage orchestration layer that combines clientpool provider resolution with objects/storage pure operations to enable multi-tenant file storage management.
|
Package objects provides storage orchestration layer that combines clientpool provider resolution with objects/storage pure operations to enable multi-tenant file storage management. |
|
ssoenforcement
Package ssoenforcement holds the db-aware loader
|
Package ssoenforcement holds the db-aware loader |
|
testutils
Package testutils provides utilities for use in tests
|
Package testutils provides utilities for use in tests |
|
trustcenterurl
Package trustcenterurl builds public trust center URLs from server-level configuration.
|
Package trustcenterurl builds public trust center URLs from server-level configuration. |
|
vendorenrich
Package vendorenrich enriches vendor entries produced by a domain scan report with known-good data pulled fromsystem-owned vendor Entity catalog, matched by name, display name, domain, or alias
|
Package vendorenrich enriches vendor entries produced by a domain scan report with known-good data pulled fromsystem-owned vendor Entity catalog, matched by name, display name, domain, or alias |
|
workflows
Package workflows provides minimal registry types for workflow ent templates
|
Package workflows provides minimal registry types for workflow ent templates |
|
workflows/engine
Package engine is the workflow engine for orchestrating workflow execution
|
Package engine is the workflow engine for orchestrating workflow execution |
|
workflows/observability
Package observability provides logging and metrics wrappers and consistency for workflows there are several functions in this package that are geared towards reducing boilerplate overhead with the main callers by pre-setting common fields such as operation origin and trigger event so that inline within the workflow package we don't have crazy verbose log and metric statements making the code harder to read
|
Package observability provides logging and metrics wrappers and consistency for workflows there are several functions in this package that are geared towards reducing boilerplate overhead with the main callers by pre-setting common fields such as operation origin and trigger event so that inline within the workflow package we don't have crazy verbose log and metric statements making the code harder to read |
|
workflows/reconciler
Package reconciler provides workflow reconciliation helpers.
|
Package reconciler provides workflow reconciliation helpers. |
|
workflows/resolvers
Package resolvers provides a registry for workflow target resolution functions
|
Package resolvers provides a registry for workflow target resolution functions |
|
pkg
|
|
|
catalog
Package catalog provides the core functionality for managing and validating the catalog of products, features, and prices in the Openlane project
|
Package catalog provides the core functionality for managing and validating the catalog of products, features, and prices in the Openlane project |
|
catalog/gencatalog
Package gencatalog is the output of parsing the catalog file
|
Package gencatalog is the output of parsing the catalog file |
|
catalog/genjsonschema
Package genjsonschema generates JSON schema files from Go structs for use in validating catalogs
|
Package genjsonschema generates JSON schema files from Go structs for use in validating catalogs |
|
catalog/genyaml
command
Package main inside of genyaml generates Go source files from a catalog YAML file
|
Package main inside of genyaml generates Go source files from a catalog YAML file |
|
celx
Package celx provides utilities for working with CEL (Common Expression Language) expressions, including environment creation, expression compilation, evaluation, and conversion between CEL values and JSON-compatible types.
|
Package celx provides utilities for working with CEL (Common Expression Language) expressions, including environment creation, expression compilation, evaluation, and conversion between CEL values and JSON-compatible types. |
|
domainscan/example
command
|
|
|
entitlements
Package entitlements is a wrapper package for the entitlements service and a basic stripe integration
|
Package entitlements is a wrapper package for the entitlements service and a basic stripe integration |
|
gala
Package gala provides durable, typed eventing primitives intended to replace ad-hoc in-memory dispatch patterns with a River-native foundation it's a black tie affair for your events, ensuring they arrive in style and on time
|
Package gala provides durable, typed eventing primitives intended to replace ad-hoc in-memory dispatch patterns with a River-native foundation it's a black tie affair for your events, ensuring they arrive in style and on time |
|
jsonx
Package jsonx provides helpers for json in/out operations
|
Package jsonx provides helpers for json in/out operations |
|
logx
Package logx is a package for logging with echo and
|
Package logx is a package for logging with echo and |
|
logx/consolelog
Package console log is a zerolog consolewriter output formatter that can be used generically with any zerolog instantiation so that it's not specific to a particular application
|
Package console log is a zerolog consolewriter output formatter that can be used generically with any zerolog instantiation so that it's not specific to a particular application |
|
mapx
Package mapx provides generic helpers for creating, cloning, merging, and querying maps and set-maps.
|
Package mapx provides generic helpers for creating, cloning, merging, and querying maps and set-maps. |
|
metrics
Package metrics holds configuration and middleware for prometheus style metrics
|
Package metrics holds configuration and middleware for prometheus style metrics |
|
middleware/auth
Package auth handles auth
|
Package auth handles auth |
|
middleware/cachecontrol
Package cachecontrol creates a cache control echo middleware
|
Package cachecontrol creates a cache control echo middleware |
|
middleware/cors
Package cors does cors stuff
|
Package cors does cors stuff |
|
middleware/csrf
Package CSRF provides middleware for handling Cross-Site Request Forgery (CSRF) protection in web applications
|
Package CSRF provides middleware for handling Cross-Site Request Forgery (CSRF) protection in web applications |
|
middleware/debug
Package debug contains utility helper functions for debugging when working with echo server
|
Package debug contains utility helper functions for debugging when working with echo server |
|
middleware/graphapi
package graphapi provides helper functions for middleware working with GraphQL API requests
|
package graphapi provides helper functions for middleware working with GraphQL API requests |
|
middleware/impersonation
Package impersonation provides middleware for handling user impersonation in HTTP requests.
|
Package impersonation provides middleware for handling user impersonation in HTTP requests. |
|
middleware/mime
Package mime does mime stuff
|
Package mime does mime stuff |
|
middleware/ratelimit
Package ratelimit implements a rate limiting middleware
|
Package ratelimit implements a rate limiting middleware |
|
middleware/secure
Package secure is middleware that provides protection against cross-site scripting (XSS) attack, content type sniffing, clickjacking, insecure connection and other code injection attacks
|
Package secure is middleware that provides protection against cross-site scripting (XSS) attack, content type sniffing, clickjacking, insecure connection and other code injection attacks |
|
middleware/transaction
Package transaction implements a transaction middleware for REST endpoints using the ent db client
|
Package transaction implements a transaction middleware for REST endpoints using the ent db client |
|
objects
Package objects provides a clean, modern object storage service with dynamic multi-provider support, context-based client injection, and integration with external credential systems.
|
Package objects provides a clean, modern object storage service with dynamic multi-provider support, context-based client injection, and integration with external credential systems. |
|
objects/storage/providers/disk
Package disk is the local disk storage provider for objects service
|
Package disk is the local disk storage provider for objects service |
|
objects/storage/providers/r2
Package r2 is the Cloudflare R2 storage provider for objects service
|
Package r2 is the Cloudflare R2 storage provider for objects service |
|
objects/storage/providers/s3
Package s3 is the AWS S3 storage provider for objects service
|
Package s3 is the AWS S3 storage provider for objects service |
|
objects/storage/proxy
Package proxy implements a storage proxy that provides presigned URL generation
|
Package proxy implements a storage proxy that provides presigned URL generation |
|
permissioncache
Package permissioncache handles permissioncache for things like features
|
Package permissioncache handles permissioncache for things like features |
|
shortlinks
Package shortlinks provides a thin helper for the hosted shortlink API
|
Package shortlinks provides a thin helper for the hosted shortlink API |
|
ssoutils
Package ssoutils provides helper functionality for OIDC-based SSO integration, helping to bridge the gap between our choices on HTTP Server, token issuance, and overall SSO flow Several of the functions in this package are used to generate URLs for SSO login and callback due to limitations within echox not allowing for easy access to route paths
|
Package ssoutils provides helper functionality for OIDC-based SSO integration, helping to bridge the gap between our choices on HTTP Server, token issuance, and overall SSO flow Several of the functions in this package are used to generate URLs for SSO login and callback due to limitations within echox not allowing for easy access to route paths |
|
urlx
Package urlx provides URL token construction and shortening utilities for embedding signed tokens in email action links
|
Package urlx provides URL token construction and shortening utilities for embedding signed tokens in email action links |
Click to show internal directories.
Click to hide internal directories.