Five integrated security domains — Zero Trust, compliance automation, supply chain security, and real-time threat detection — running locally in under 5 minutes.
Built for technical evaluation — every claim is runnable code.
Zero Trust core (Keycloak + OPA + Vault) with MITRE ATT&CK coverage. Every inter-service call is authenticated, authorized, and logged — no implicit trust.
SOC2, HIPAA, PCI-DSS, and GDPR controls as version-controlled code. Live pass/fail dashboard with simulated drift injection and auto-recovery.
11 integrated services: Kubernetes, Istio, Prometheus, Grafana, HashiCorp Vault, Keycloak, OPA, SonarQube, Trivy, Semgrep, and MobSF.
End-to-end coverage from code commit to mobile runtime.
Node.js Express with defense-in-depth controls at every pipeline stage.
NIST SP 800-207 Zero Trust framework — identity-first, every request verified.
Multi-cloud IaC security across AWS, Azure, and GCP with CIS Benchmarks.
Continuous compliance monitoring with live pass/fail dashboard and drift simulation.
iOS and Android security pipeline covering the OWASP Mobile Security Testing Guide.
Screenshots captured from running services — every tool is operational, not mocked.
Five domains unified through a shared Zero Trust core. Every inbound request passes through Keycloak (authentication) → OPA (authorization) → Vault (secret resolution) before reaching the application layer.
Runtime telemetry flows from all services to Prometheus, visualized in Grafana, with Alertmanager routing critical events. The compliance layer continuously evaluates control status and exposes Prometheus metrics for drift alerting.
Full architecture diagram →
┌─ Attack Surface ───────────────────────────────────┐
│ Code Commits · Mobile Apps · Cloud IaC · Web API │
└───────────────────────┬────────────────────────────┘
│ Pipeline Security Gates
│ SAST · DAST · Checkov
│ MobSF · detect-secrets
▼
┌─ Zero Trust Core ──────────────────────────────────┐
│ Keycloak (OIDC/MFA) → OPA (ABAC) → Vault (PKI) │
└───────────────────────┬────────────────────────────┘
│ Authenticated & Authorized
▼
┌─ Application + Runtime Security ───────────────────┐
│ Demo App · Falco · Istio mTLS · Prometheus │
└───────────────────────┬────────────────────────────┘
│ Continuous Monitoring
▼
┌─ Compliance & Evidence ─────────────────────────────┐
│ SOC2 · HIPAA · PCI-DSS · GDPR controls + reports │
└─────────────────────────────────────────────────────┘
Each scenario runs a real attack, then shows the platform detecting and blocking it.
Simulates repeated login failures against Keycloak. Triggers
account lockout after 3 attempts, fires a Prometheus alert, and
visualizes the
authentication_failures spike
in Grafana within seconds.
./shared/scripts/demo-attack.sh brute-force
Attempts to use a developer-role token to access an admin-only resource. OPA evaluates the ABAC policy and returns a denial — no code change required, policy-as-code enforces the boundary.
./shared/scripts/demo-privilege-esc.sh
Injects a SOC2 CC1.0 control failure into the compliance reporter. The live dashboard turns red, a Prometheus alert fires, and the auto-recovery endpoint restores green status.
./shared/scripts/demo-compliance.sh inject-drift
Injects a malicious dependency into the application, then runs a Trivy scan in the CI pipeline. Trivy exits with code 1, blocking the build before deployment.
./shared/scripts/demo-supply-chain.sh inject &&
./shared/scripts/demo-supply-chain.sh scan
Injects a hardcoded API key into mobile source code, then runs the Semgrep pipeline. The key is detected and flagged in under 2 seconds — before it can reach version control.
./shared/scripts/demo-mobile-leak.sh inject &&
./shared/scripts/demo-mobile-leak.sh scan
Runs locally with Docker. All services healthy in ~2 minutes.
git clone https://github.com/dbsectrainer/controlplane
cd controlplane
./shared/scripts/demo-setup.sh
docker-compose up -dRequires Docker Desktop · 8 GB RAM · Ports 3000, 3100, 8080, 8088, 8200
Full guide for hiring managers →Every tool is configured, integrated, and runnable — not just listed.