Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!
Aurea — Aurea is an open-source, AI-powered platform that secures infrastructure-as-code (IaC) across Terraform, Kubernetes, Docker, and Ansible. It integrates with CI/CD pipelines to scan for misconfigurations, detect vulnerabilities, enforce policies, and provide actionable remediation guidance. With predictive AI, collaboration tools, and enterprise-grade governance, Aurea ensures that infrastructure is secure, compliant, and resilient from development to deployment. https://gitlab.com/Roxanne_Ardary/aurea/ | Kitploit
Aurea is an open-source, AI-powered platform that secures infrastructure-as-code (IaC) across Terraform, Kubernetes, Docker, and Ansible. It integrates with CI/CD pipelines to scan for misconfigurations, detect vulnerabilities, enforce policies, and provide actionable remediation guidance. With predictive AI, collaboration tools, and enterprise-grade governance, Aurea ensures that infrastructure is secure, compliant, and resilient from development to deployment. https://gitlab.com/Roxanne_Ardary/aurea/
Aurea is a fully open-source, AI-powered Infrastructure-as-Code security specification designed to provide continuous security analysis throughout the software development and infrastructure deployment lifecycle.
Aurea analyzes infrastructure definitions, identifies vulnerabilities and misconfigurations, evaluates security and compliance policies, provides AI-assisted remediation, and integrates directly into CI/CD and GitOps workflows.
Aurea is designed as a modular security system. Core modules provide the foundational security capabilities required by the specification. Optional plugin modules extend Aurea with additional infrastructure formats, cloud providers, compliance frameworks, AI systems, integrations, reporting systems, and specialized security capabilities.
Aurea is designed around local-first operation, vendor neutrality, explainable AI, least privilege, zero-trust principles, human oversight, reproducibility, and airtight service isolation.
Design Goals
Provide open-source IaC security automation
Detect infrastructure vulnerabilities before deployment
Integrate security directly into CI/CD pipelines
Support continuous infrastructure security validation
Combine deterministic analysis with AI-assisted analysis
Provide explainable security findings
Prioritize security risks according to context and impact
Provide actionable remediation guidance
Support policy-as-code
Support compliance validation
Provide infrastructure drift detection
Support security testing across development and deployment environments
Enable controlled adversarial AI testing
Maintain strict isolation between services and AI agents
Provide enterprise governance without requiring proprietary infrastructure
Remain modular and extensible
Avoid vendor lock-in
Support local and offline security analysis where practical
Core Architecture Principles
Modular Design
Aurea consists of independently defined modules with clear interfaces and responsibilities.
Core modules provide essential Aurea functionality.
Optional plugin modules extend Aurea without requiring changes to the core security engine.
Modules should communicate through documented interfaces and should not require unnecessary coupling.
Local-First Security
Aurea should support local execution whenever practical.
Security analysis should not require sending infrastructure code, credentials, secrets, or security findings to an external service.
External services should be optional integrations rather than mandatory dependencies.
Security by Default
Aurea must default to restrictive security settings.
Unsafe functionality must require explicit authorization.
High-impact actions must require explicit policy authorization and, where configured, human approval.
Least Privilege
Every Aurea service, module, plugin, integration, and AI agent should receive only the permissions required to perform its assigned function.
Zero-Trust Architecture
Aurea services must not implicitly trust one another.
Authentication, authorization, and capability validation should occur at service boundaries.
Airtight Service Isolation
Aurea must maintain strict isolation between services, plugins, AI agents, evaluation environments, credentials, and target infrastructure.
Security boundaries must be enforced by the execution environment and policy engine rather than relying solely on AI instructions.
Core Modules
IaC Analysis Module
The IaC Analysis Module provides the foundational analysis engine for Infrastructure-as-Code.
Supported Infrastructure Formats
Terraform
Kubernetes manifests
Dockerfiles
Ansible
CloudFormation
Helm
Additional formats through plugins
Analysis Capabilities
IaC parsing
Syntax analysis
Semantic analysis
Configuration analysis
Misconfiguration detection
Insecure default detection
Excessive privilege detection
Public exposure detection
Network security analysis
Identity and access analysis
Encryption configuration analysis
Storage security analysis
Logging configuration analysis
Monitoring configuration analysis
Backup configuration analysis
Container configuration analysis
Infrastructure dependency analysis
Infrastructure attack-surface analysis
Zero-trust readiness analysis
Security Rules Module
The Security Rules Module provides deterministic security detection.
Capabilities
Built-in security rules
Custom security rules
Rule severity
Rule categories
Rule identifiers
Rule descriptions
Rule remediation guidance
Rule versioning
Rule validation
Rule testing
Rule suppression
Rule exceptions
Rule expiration
Rule inheritance
Rule conflict detection
Organization-specific rules
Secrets Security Module
The Secrets Security Module identifies potentially exposed credentials and sensitive information.
Capabilities
Hardcoded secret detection
Credential detection
API key detection
Token detection
Private key detection
Password detection
Secret pattern analysis
Secret redaction
Secret exposure reporting
Secret remediation guidance
Secret scanning in IaC
Secret scanning in configuration files
The module must prevent discovered secrets from being unnecessarily exposed in logs, reports, AI prompts, or external integrations.
Dependency and Supply Chain Module
The Dependency and Supply Chain Module evaluates dependencies associated with infrastructure.
Capabilities
IaC module analysis
Terraform module analysis
Container image analysis
Dependency vulnerability detection
Dependency version analysis
Known vulnerability correlation
Dependency provenance analysis
Supply-chain risk analysis
Dependency risk scoring
Dependency update recommendations
Malicious dependency detection where supported
Dependency policy enforcement
Risk Intelligence Module
The Risk Intelligence Module evaluates and prioritizes security findings.
Capabilities
Severity classification
Risk scoring
Business-impact scoring
Exploitability scoring
Exposure scoring
Asset criticality scoring
Composite risk scoring
Risk prioritization
Risk aggregation
Risk correlation
Risk trend analysis
Risk aging analysis
Risk heatmaps
Attack-path prioritization
Environment-aware risk scoring
Custom organizational risk models
Risk acceptance workflows
AI Security Analysis Module
The AI Security Analysis Module provides AI-assisted infrastructure security analysis.
Capabilities
AI-powered IaC analysis
Context-aware security analysis
Infrastructure architecture understanding
Cross-file reasoning
Cross-resource reasoning
Cross-language reasoning
Security intent detection
AI anomaly detection
AI threat modeling
Attack-path reasoning
Predictive risk analysis
Predictive misconfiguration analysis
False-positive reduction
AI confidence scoring
Explainable AI findings
Natural-language security queries
Natural-language infrastructure analysis
AI-generated security recommendations
AI-assisted compliance analysis
AI-assisted policy creation
AI-generated findings must remain distinguishable from deterministic security findings.
AI Agent Module
The AI Agent Module provides controlled AI agents for Aurea security workflows.
Agent Types
Security analyst agents
Code review agents
Infrastructure security agents
Red-team agents
Blue-team agents
Remediation agents
Policy agents
Compliance agents
Threat analysis agents
Agent Controls
Agent identity
Agent authentication
Agent authorization
Capability profiles
Tool permissions
File permissions
Network permissions
API permissions
Resource limits
Execution limits
Action restrictions
Target restrictions
Agent activity logging
Agent decision auditing
Agent termination controls
AI agents must not be able to grant themselves additional permissions.
Policy-as-Code Module
The Policy-as-Code Module provides centralized security policy enforcement.
Capabilities
Security policies
Compliance policies
Organization policies
Project policies
Environment policies
Policy inheritance
Policy versioning
Policy exceptions
Policy expiration
Policy testing
Policy validation
Policy conflict detection
Policy enforcement
Policy simulation
Natural-language policy generation
AI-assisted policy creation
Compliance Module
The Compliance Module maps infrastructure configurations to security and regulatory requirements.
Capabilities
CIS mapping
SOC 2 mapping
ISO 27001 mapping
HIPAA mapping
GDPR mapping
Custom compliance frameworks
Compliance scoring
Compliance coverage analysis
Compliance gap analysis
Evidence collection
Audit-ready reporting
Compliance trend analysis
Compliance policy enforcement
Remediation Module
The Remediation Module provides security remediation recommendations and controlled automated fixes.
Capabilities
Remediation recommendations
Secure configuration examples
AI-generated patches
AI-generated IaC corrections
Auto-fix suggestions
Remediation previews
Remediation validation
Post-remediation rescanning
Rollback support
Fix prioritization
Remediation tracking
Remediation history
Fix effectiveness analysis
Automatic remediation must be configurable and must support human approval for high-impact actions.
CI/CD Security Module
The CI/CD Security Module integrates Aurea directly into development pipelines.
Capabilities
Pipeline-native scanning
Pull request scanning
Merge request scanning
Commit-triggered scanning
Pre-commit scanning
Changed-file scanning
Incremental scanning
Full repository scanning
Pipeline security gates
Configurable failure thresholds
Warning-only mode
Security approval gates
Build blocking
Deployment protection
Pipeline artifacts
Security result publishing
CI/CD Platforms
GitHub Actions
GitLab CI
Jenkins
CircleCI
Bitbucket Pipelines
Generic CI/CD systems
CLI Module
The CLI Module provides local and automated command-line access.
Capabilities
Local scanning
Repository scanning
Directory scanning
File scanning
Configuration management
Policy execution
Report generation
AI queries
Finding management
Remediation workflows
Pipeline execution
Baseline management
Plugin management
Developer Security Module
The Developer Security Module provides security feedback directly within development workflows.
Capabilities
Developer-friendly findings
Inline security guidance
Pull request comments
Merge request comments
Pre-commit hooks
IDE integration
Editor diagnostics
Secure configuration examples
Remediation guidance
Finding ownership
Finding suppression
Finding expiration
Infrastructure Intelligence Module
The Infrastructure Intelligence Module creates a security-aware representation of infrastructure.
Capabilities
Infrastructure inventory
Resource discovery
Resource classification
Resource relationship mapping
Infrastructure dependency graphs
Security architecture visualization
Internet exposure mapping
Network topology analysis
IAM relationship analysis
Infrastructure attack graphs
Configuration dependency analysis
Environment comparison
Drift Detection Module
The Drift Detection Module compares declared infrastructure with deployed infrastructure.
Capabilities
IaC-to-runtime comparison
Configuration drift detection
Unauthorized change detection
Drift history
Drift classification
Drift risk scoring
Drift remediation recommendations
Runtime-to-IaC reconciliation
Continuous drift monitoring
Runtime Security Module
The Runtime Security Module provides optional continuous infrastructure security analysis.
Capabilities
Runtime configuration monitoring
Cloud event-triggered scans
Kubernetes event-triggered scans
Runtime policy validation
Configuration change tracking
Runtime anomaly detection
Runtime risk scoring
Runtime-to-IaC comparison
Cloud Security Module
The Cloud Security Module provides cloud infrastructure security analysis.
Supported Platforms
AWS
Microsoft Azure
Google Cloud
OpenStack
Hybrid environments
Capabilities
Cloud account analysis
Cloud project analysis
Cloud resource analysis
Cloud posture analysis
Cross-cloud risk analysis
Cross-cloud policy enforcement
Cloud configuration validation
Container and Kubernetes Security Module
The Container and Kubernetes Security Module provides containerized infrastructure security analysis.
Capabilities
Kubernetes security analysis
Pod security analysis
Namespace security analysis
RBAC analysis
Network policy analysis
Service exposure analysis
Ingress security analysis
Container privilege analysis
Image configuration analysis
Dockerfile analysis
Container vulnerability integration
Helm analysis
Kubernetes policy enforcement
GitOps security validation
Collaboration Module
The Collaboration Module provides team-based security workflows.
Capabilities
Finding assignment
Task management
Finding comments
Security discussions
Remediation ownership
Escalation workflows
Team dashboards
Developer dashboards
Security dashboards
Executive dashboards
Team security scorecards
Security notifications
Critical-risk alerts
Remediation reminders
Collaboration history
Enterprise Governance Module
The Enterprise Governance Module provides organization-wide security controls.
Capabilities
Role-based access control
Multi-tenant architecture
Team permissions
Project permissions
Environment permissions
Organization governance
Centralized policy management
Enterprise policy inheritance
Governance dashboards
Cross-team visibility
Cross-project visibility
Centralized finding management
Security ownership
Approval workflows
Exception management
Risk acceptance
Administrative activity logging
AI decision auditing
Remediation auditing
Reporting and Analytics Module
The Reporting and Analytics Module provides security visibility and historical analysis.
Capabilities
Security posture dashboards
Risk dashboards
Compliance dashboards
Infrastructure dashboards
Executive summaries
Developer dashboards
Historical trend analysis
Vulnerability trends
Misconfiguration trends
Compliance trends
Team performance metrics
Mean-time-to-remediation tracking
Open-risk tracking
Risk aging analysis
Custom reports
Scheduled reports
Audit evidence export
Output Formats
HTML
PDF
JSON
YAML
SARIF
CLI output
Threat Intelligence Module
The Threat Intelligence Module correlates infrastructure findings with security intelligence.
Capabilities
CVE intelligence
Security advisory integration
IaC module intelligence
Container image intelligence
Threat pattern library
Misconfiguration knowledge base
Attack-pattern correlation
Emerging threat detection
Threat-informed risk scoring
Security intelligence updates
Threat intelligence history
Simulation and Testing Module
The Simulation and Testing Module provides controlled security testing before deployment.
Capabilities
IaC simulation
What-if analysis
Configuration comparison
Pre-deployment testing
Deployment impact analysis
Policy impact analysis
Security regression testing
Infrastructure test scenarios
Sandbox validation
Attack-path simulation
Remediation simulation
Configuration change preview
AI Security Hackathon Module
The AI Security Hackathon Module provides isolated environments where AI systems can test and evaluate one another's security capabilities.
AI-versus-AI Testing
AI attacker agents
AI defender agents
AI red-team agents
AI blue-team agents
AI security analyst agents
AI code-review agents
AI infrastructure-security agents
AI policy agents
AI remediation agents
Multi-agent competitions
Agent-versus-agent testing
Automated security challenges
Security benchmark competitions
Infrastructure security challenges
Blind testing scenarios
Repeated adversarial testing
Automated challenge generation
Configurable difficulty
Agent performance scoring
Detection accuracy scoring
Remediation accuracy scoring
False-positive measurement
False-negative measurement
Explainability scoring
Response-time measurement
Resource-efficiency measurement
Hackathon Isolation
Every hackathon environment must operate within an explicit security boundary.
Dedicated sandbox environments
Ephemeral environments
Container isolation
Virtual machine isolation where required
Network segmentation
Default-deny networking
Explicit network allowlists
No unrestricted internet access
No production access
No production credentials
No CI/CD credential access
No host credential access
No unrelated repository access
No unrestricted filesystem access
No privileged containers
Restricted system calls
CPU limits
Memory limits
Storage limits
Process limits
Execution time limits
API allowlists
Short-lived credentials
Automatic credential revocation
Secret isolation
Controlled artifact exchange
Immutable sandbox boundaries
Automatic environment destruction
Authorized Test Targets
AI agents may interact only with explicitly authorized targets.
Synthetic infrastructure
Intentionally vulnerable IaC
Disposable cloud environments
Local test clusters
Ephemeral Kubernetes environments
Temporary Terraform environments
Mock APIs
Simulated cloud services
Security challenge environments
Synthetic credentials
Synthetic secrets
Synthetic identities
Synthetic datasets
Production infrastructure must never be used as an AI hackathon target.
Agent Capability Boundaries
Every participating AI must receive an explicit capability profile.
Read permissions
Write permissions
Execute permissions
Network permissions
API permissions
File permissions
Tool permissions
Target restrictions
Action restrictions
Time restrictions
Resource restrictions
Aurea must enforce these capabilities externally.
AI Attack Simulation
Authorized attacker agents may evaluate isolated targets for:
IaC misconfigurations
Excessive privileges
Public exposure
Weak network controls
Insecure storage
Missing encryption
Weak authentication
Kubernetes weaknesses
Container weaknesses
Policy violations
Configuration weaknesses
Infrastructure attack paths
Security regressions
All testing must remain within authorized environments.
AI Defense Simulation
Defender agents may:
Detect simulated attacks
Identify vulnerable configurations
Analyze attack paths
Recommend mitigations
Generate remediation patches
Apply approved fixes
Re-scan infrastructure
Validate remediation
Monitor simulated environments
Update defensive policies
Produce incident reports
Independent Evaluation
The evaluation system must remain independent from competing agents.
Deterministic scoring where possible
Independent evaluation engine
Reproducible challenges
Reproducible environments
Evidence-based scoring
Attack success measurement
Detection measurement
Remediation measurement
Regression measurement
Resource consumption measurement
Complete test logs
Immutable result records
Challenge replay
Hackathon Security Controls
Sandbox policy enforcement
Network policy enforcement
Capability enforcement
Resource enforcement
Execution monitoring
Process monitoring
File-access monitoring
API monitoring
Credential monitoring
Secret redaction
Security event logging
Anomaly detection
Escape detection
Abuse detection
Automatic agent termination
Automatic sandbox termination
Emergency kill switch
Environment destruction after testing
Escape Prevention
Sandbox escape attempts must be treated as security events.
Aurea should automatically terminate or quarantine an execution attempting to:
Access unauthorized files
Access unauthorized services
Obtain elevated privileges
Escape its execution environment
Access host resources
Access production systems
Access unauthorized credentials
Circumvent network restrictions
Modify security controls
Disable monitoring
Modify the evaluator
Modify scoring mechanisms
Hackathon Modes
AI versus AI
AI versus baseline
AI versus challenge
Multi-agent battle
Cooperative defense
Red team versus blue team
Remediation race
Security regression challenge
Human versus AI
AI tournament
Hackathon Reporting
Each competition should produce a complete security report containing:
Participating agents
Agent versions
Models used
Tool permissions
Challenge configuration
Target configuration
Security controls
Attack attempts
Successful findings
Defensive detections
Remediation actions
Failed actions
Sandbox violations
Resource consumption
Execution times
Scores
Reproducibility information
Security recommendations
API and Integration Module
The API and Integration Module provides programmatic access to Aurea.
Capabilities
REST API
GraphQL API
CLI API access
Webhooks
Event-driven integrations
Authentication
Authorization
API key management
Short-lived credentials
Integration policies
Rate limiting
Audit logging
Plugin System
Aurea supports optional plugin modules that extend the core system without requiring modifications to core modules.
Plugins must use documented interfaces and must operate within Aurea's security and permission model.
Optional Plugin Modules
IaC Parser Plugins
Additional IaC languages
Additional configuration formats
Custom parsers
Organization-specific formats
Cloud Provider Plugins
Additional public cloud providers
Private cloud platforms
Edge environments
Infrastructure platforms
Cloud management systems
Compliance Plugins
Industry-specific frameworks
Regional frameworks
Organizational standards
Custom regulatory mappings
Internal security standards
Security Rule Plugins
Community rules
Organization-specific rules
Industry-specific rules
Experimental detection rules
Research rules
Custom vulnerability patterns
AI Provider Plugins
Local AI models
Self-hosted models
Open-source AI models
Optional external AI providers
Specialized security models
Custom inference engines
AI provider plugins must not bypass Aurea's data protection, permission, or isolation controls.
Threat Intelligence Plugins
Vulnerability databases
Security advisory feeds
Threat intelligence systems
Organization-specific intelligence
Security research feeds
CI/CD Plugins
Additional pipeline systems
Build systems
Deployment systems
GitOps systems
Release systems
Cloud Runtime Plugins
Runtime monitoring systems
Cloud event systems
Kubernetes runtime systems
Container runtime systems
Infrastructure management systems
Notification Plugins
Slack
Microsoft Teams
Discord
Email
Webhooks
Incident management systems
Security operations systems
SIEM and SOAR Plugins
Elastic
Splunk
Grafana
Cortex XSOAR
Other compatible security platforms
Reporting Plugins
Custom dashboards
Custom report formats
Executive reporting systems
Compliance reporting systems
Audit systems
Ticketing Plugins
Issue trackers
Security ticketing systems
Project management systems
Remediation workflows
Storage Plugins
Local storage
Object storage
Database systems
Security data warehouses
Plugins must not weaken Aurea's security model.
Plugin Security Requirements
Every plugin must:
Declare required capabilities
Declare required permissions
Declare required network access
Declare required data access
Use authenticated interfaces
Follow least-privilege requirements
Respect Aurea policy enforcement
Respect service isolation
Provide version information
Provide dependency information
Support security validation
Generate auditable activity
Avoid unauthorized data collection
Avoid unauthorized external communication
Plugins must not automatically receive access to secrets, production infrastructure, CI/CD credentials, or unrestricted network resources.
Automation Module
The Automation Module orchestrates recurring and event-driven security workflows.
Capabilities
Scheduled scans
Event-driven scans
Commit-triggered scans
Pull request-triggered scans
Merge-triggered scans
Deployment-triggered scans
Cloud-event-triggered scans
Automatic report generation
Automatic ticket creation
Automatic notification routing
Automatic remediation proposals
Approval-based remediation
Automated compliance evidence collection
Automated security score updates
Automated AI security competitions
Automated challenge provisioning
Automated sandbox provisioning
Automated sandbox destruction
Knowledge Base Module
The Knowledge Base Module provides structured security intelligence for deterministic and AI-assisted analysis.
Capabilities
Security knowledge base
IaC pattern library
Secure configuration library
Misconfiguration archetypes
Remediation pattern library
Compliance knowledge base
Threat knowledge base
AI retrieval
Organization-specific knowledge
Project-specific security context
Historical finding context
Versioned security intelligence
Adversarial testing knowledge
AI security benchmark knowledge
Audit Module
The Audit Module records security-relevant Aurea activity.
Capabilities
Security finding history
Policy history
Configuration history
Remediation history
AI decision history
Agent activity history
Plugin activity history
Administrative activity history
Hackathon activity history
Sandbox events
Authentication events
Authorization events
Security violations
Immutable audit records
Security Module
The Security Module provides security controls for Aurea itself.
Capabilities
Secure-by-default configuration
Local-first operation
Offline operation
Data minimization
Configurable telemetry
Secrets redaction
Sensitive-data protection
Encrypted communications
Secure credential handling
Least-privilege execution
AI sandboxing
Agent isolation
Plugin isolation
Service isolation
Network segmentation
Zero-trust service communication
Human approval for high-impact actions
Immutable audit logging
Supply-chain security
Signed releases
Dependency verification
Reproducible builds
Continuous security validation
Security testing of Aurea
Open Source and Community Module
The Open Source and Community Module supports community participation and extension.
Capabilities
Open-source core
Transparent security rules
Community rule contributions
Community plugins
Community policy packs
Community compliance packs
Community AI models
Public security knowledge
Open training datasets
Open security benchmarks
Community hackathons
Community AI challenges
Rule development framework
Plugin development framework
AI agent development framework
Contributor recognition
Security disclosure process
Security research participation
Benchmarking Module
The Benchmarking Module provides reproducible evaluation of Aurea and participating AI systems.
Capabilities
Security benchmarks
IaC security benchmarks
AI security benchmarks
Agent benchmarks
Detection benchmarks
Remediation benchmarks
Compliance benchmarks
Performance benchmarks
Resource-efficiency benchmarks
Regression benchmarks
Reproducible test environments
Standardized scoring
Benchmark history
Comparative analysis
Future Expansion
Aurea may support future capabilities including:
Self-healing IaC
Autonomous security governance
Autonomous security testing
Predictive compliance
Predictive remediation
Cross-project intelligence
Cross-environment intelligence
Advanced attack-path reasoning
Autonomous infrastructure security agents
Security policy evolution
Continuous security optimization
Advanced infrastructure simulation
Federated security intelligence
Privacy-preserving collaborative learning
Autonomous AI security tournaments
Continuous adversarial AI evaluation
Future capabilities must preserve Aurea's security, isolation, transparency, and human-governance requirements.
Security Requirements
Aurea must prioritize the protection of:
Infrastructure source code
Credentials
Secrets
AI model inputs
AI model outputs
Security findings
Compliance information
Cloud credentials
CI/CD credentials
Runtime credentials
Audit records
Customer data
Organizational security information
No module, plugin, integration, or AI agent may bypass the Aurea security model.
AI Safety Requirements
AI systems operating within Aurea must be treated as untrusted components.
AI systems must not independently:
Expand their permissions
Disable security controls
Disable monitoring
Access unauthorized services
Access production infrastructure
Access unauthorized credentials
Modify their own security boundaries
Modify the evaluation system
Modify scoring mechanisms
Circumvent network controls
Escape an authorized sandbox
High-impact actions must be governed by explicit policy and configurable human approval.
Service Isolation Requirements
All Aurea services must communicate through explicitly authorized interfaces.
Service isolation must include:
Authentication
Authorization
Capability validation
Network segmentation
API allowlisting
Resource limits
Credential isolation
Secret isolation
Logging
Monitoring
Failure containment
Automatic termination where required
A compromised service must not automatically provide access to unrelated services or infrastructure.
Performance Requirements
Aurea should support:
Incremental scanning
Parallel analysis
Changed-file analysis
Caching
Configurable scan depth
Resource limits
Pipeline-friendly execution
Local execution
Large repository analysis
Large infrastructure analysis
Security accuracy must take precedence over scan speed where the two conflict.
Aurea is released under the GNU Affero General Public License v3.0 or later (AGPL-3.0+).
By contributing to this project, you agree that your contributions will also be released under this license.
Please note the following:
All contributions must comply with the AGPL-3.0+ terms.
Under Section 7 of the license, all redistributions, forks, and derivative works must preserve attribution to: Roxanne Ardary and roxanneardary.com.
Aurea specifications are free to use with attribution. A Specification Branding License can be negotiated upon request.
The project's notice.md file tracks attribution requirements and contributor acknowledgments.
Any update that adds new contributors or modifies attribution should also update notice.md.
When submitting a pull request, ensure that any new files maintain the attribution headers where applicable.
Network-deployed versions of this software must also remain fully AGPL-3.0+ compliant, including exposure of source code modifications when applicable under the license.
For full legal details, please refer to the AGPL-3.0+ license and the project's notice.md file.
