Security & ComplianceCase study
Continuous Compliance as Code
Compliance automation in Go that continuously scans GitHub repositories against OSPS Baseline, NIST 800-53, and SSDF, and reports findings where developers already work.
- Company
- Revanite
- Role
- Software Engineer
- Timeline
- Jul 2025 – Jan 2026
Impact
~80%
Fewer false positives
15+
Production UI pages
3
Frameworks mapped
The problem
Proving compliance with OSPS Baseline, NIST 800-53, and SSDF across large GitHub estates meant periodic, manual audits that were out of date as soon as they finished.
Existing scanning was noisy: too many false positives meant real findings got ignored.
What I built
- 1
Pipelines in Go
Built and scaled compliance automation pipelines in Go aligned with OSPS Baseline, NIST 800-53, and SSDF for continuous scanning across large GitHub repositories.
- 2
Standard evaluations
Implemented Gemara-compatible evaluation workflows and Privateer-based scanners so every control is evaluated the same way.
- 3
Results where developers look
Emitted SARIF so findings show up natively in GitHub CI/CD, and built GitHub Actions workflows that run security assessments automatically.
- 4
A UI for the policy side
Designed and delivered a compliance UI and transformer API in React and TypeScript for policy management, control catalogs, and standards mapping across 15+ production pages.
How it flows
01
Controls
OSPS Baseline, NIST 800-53, SSDF catalogs
02
Scan
Privateer runs in GitHub Actions
03
Evaluate
Gemara-compatible workflows
04
Report
SARIF into GitHub + compliance UI
The results
- False positives dropped by approximately 80%.
- Compliance became continuous and enforced as policy-as-code in cloud-native environments.
- Policy owners got a 15+ page UI for catalogs and standards mapping.
Stack
- Go
- Privateer
- Gemara
- SARIF
- GitHub Actions
- React
- TypeScript
- NIST 800-53
Next case study
Spyre CI/CD Modernization