Show HN: GitHub scanner that finds real ISO 27001/SoC 2 gaps – no AI, no signup

Category: security

Tags: security, compliance, github, scanner, devops

Score: 4.3/10 (Innovation: 4, Technical: 5, Documentation: 3, Utility: 4)

Normos offers a free GitHub security scanner that uses deterministic detectors to find compliance gaps relevant to ISO 27001 and SOC 2, such as unpinned GitHub Actions and secret filenames. It requires no signup and discards results after display, serving as a lead magnet for their full compliance platform. The project is a commercial tool rather than open-source, and the scan covers only 4 of 33 detectors.

Target audience: devops, security engineers, compliance officers

Repository: https://normos.io/free-github-scan

View on Hacker News