Minder by Custcodian installs statistics

Minder is an OpenSSF project providing an open source supply chain security platform to enable continuous supply chain policy evaluation and remediation. This instance is run by Custcodian for community and private use.

To use Minder with private repositories, contact support@custcodian.dev or sponsor at $25/month for 10 repositories.

Capabilities

• Define policies to apply to some or all enrolled repositories across multiple GitHub organizations • Example: apply certain policies only to .github repos, or to repositories containing Python code • Continuously validates repository settings using extensible Rego-based rules • Enforce standards like SAST (semgrep or codeql) across all repositories • Collect inventory of AI skills or documentation files (.md) across repositories • Enforce common repository layout and files (LICENSE, CODE-OF-CONDUCT, etc) • Automatically remediate repositories and PRs which violate controls • Minder can generate pull requests, manage API settings, and comment on PRs when a policy is violated

Benefits

• Custom policy enforcement. With Rego-based control validation, you can define your own policy requirements, rather than being limited to a fixed set of built-in GitHub policies. • Continuous compliance with policy controls. Minder evaluates entities on each change to validate that policy controls are still in place. • Level-based control, modelled off Kubernetes and other cloud native control systems. Minder aims to make your supply chain security as flexible and extensible as your infrastructure security. • Managed Control Plane by using the Custcodian managed instance, you avoid needing to run your own infrastructure.

Getting Started

• Install the minder CLI • Run minder auth login to create your project. • Run minder apply -f policies/ (for example, use https://github.com/custcodian/minder-rules-and-profiles/tree/main/top-5)