Open-Source SOC 2 Evidence Collector Offers Free Audit Prep Tool for Small Teams

·2 views

Developer Suman Shashikumar has built and released an open-source tool called SOC 2 Evidence Collector, designed to help small engineering teams automate audit evidence gathering without paying for commercial platforms. The lightweight tool connects to AWS and GitHub in read-only mode, checking controls such as IAM MFA status, CloudTrail logging, S3 bucket access settings, and GitHub branch protection rules. Each finding is automatically mapped to the relevant SOC 2 Trust Service Criterion, replacing hours of manual screenshotting and log exporting before an auditor's review. Built on a FastAPI backend with a simple frontend dashboard, the tool is positioned as a free starting point for a team's first audit cycle rather than a replacement for enterprise solutions like Vanta or Drata. Development surfaced real-world API edge cases, including differences between GitHub personal accounts and organizations that can cause silent, misleading responses around branch protection status.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Tutorial: Using Oura Ring Sleep Data and Random Forest to Predict Developer Fatigue

A developer tutorial published on DEV Community demonstrates how to build a fatigue prediction model by combining wearable health data with machine learning. The project uses the Oura Ring API to pull physiological metrics such as heart rate variability, sleep stages, and temperature deviation. These signals are processed with the Polars DataFrame library and fed into a Scikit-learn Random Forest regressor to generate a Cognitive Load Score between 0 and 100. Productivity labels can be sourced manually or synced from GitHub pull request velocity data to train the model. The tutorial aims to help developers move beyond guesswork about burnout by grounding productivity insights in measurable biological data.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

MyZubster Metaverse Rolls Out Server-Side Safety Tools for Virtual Rooms

MyZubster has detailed a set of server-authoritative safety and moderation features built into its metaverse platform. Virtual rooms follow a strictly controlled lifecycle — from draft to live to ended — with all state transitions validated on the backend to prevent client-side manipulation. Hosts can manage participants, issue expiring single-use private invitations, and control stage access through a moderation interface that avoids exposing internal account identifiers. Room-scoped chat is tied to verified participant sessions, subject to rate limiting and sanitization, and messages expire automatically after 24 hours. The platform currently uses resilient polling for session synchronization, with a dedicated real-time system planned for future integration.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

GEO Experiments: Third-Party Brand Mentions May Outweigh Owned Content in AI Search

Two generative engine optimization (GEO) experiments suggest that mentions of a brand in credible third-party sources may carry more weight than a brand's own website content when AI-driven search tools generate responses. While owned website content remains important as a foundation for clarity and credibility, the research challenges the assumption that optimizing on-site pages alone will reliably boost AI visibility. The findings point to a more source-focused strategy, where marketers identify which trusted publications and resources AI platforms repeatedly cite for relevant topics. Businesses are advised to build legitimate presence in those sources through sustained PR efforts, editorial coverage, and content collaborations rather than relying solely on publishing more pages. A practical starting point is mapping the sources that recur in AI-generated answers for key topics and assessing realistic paths to earning mentions within them.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Self-hosting an AI code reviewer hinges on where the model runs, not the tool

Teams evaluating self-hosted AI code review tools face a critical but often overlooked choice: whether the underlying language model runs on their own hardware or on a third-party API. PR-Agent, an open-source reviewer now maintained by its own GitHub org after being donated by Qodo, illustrates three distinct deployment configurations — hosted model with self-hosted app, fully local model and app, or fully hosted by a vendor. Only the fully local setup, using tools like Ollama routed through LiteLLM, ensures code never leaves internal infrastructure and gives the term 'private' genuine meaning. Teams comfortable calling an external LLM API need only reconsider their tooling, while those with strict data boundaries must also evaluate which local model delivers trustworthy review quality. The answer to the model-placement question is best found in a tool's own repository and documentation, not in third-party comparison articles.

0 comments Read more at DEV Community