{"repo":"grcorsair/corsair","free":true,"listed":false,"github":"https://github.com/grcorsair/corsair","clone":"git clone https://github.com/grcorsair/corsair.git","description":"Compliance trust shouldn't require emailing PDFs and hoping nobody tampered with them. Corsair signs compliance findings as verifiable digital certificates that anyone can check with a standard JWT library.","language":"TypeScript","stars":14,"topics":["compliance","did-web","ed25519","grc","jwt","scitt","bun","soc2","typescript","verifiable-credentials"],"license":"Apache-2.0","category":"auth-billing-email","readme_excerpt":"Your security tools already know if your controls work. Nobody can verify that. Until now. Website · Documentation · CPOE Spec · Verify a CPOE · Generate trust.txt --- The Problem Compliance trust today is exchanged via PDF. SOC 2 reports, pentest results, ISO 27001 certificates — emailed as attachments, stored in shared drives, re-requested every quarter. They are machine-unreadable , unverifiable , and impossible to validate without trusting the sender. The Solution CORSAIR signs tool output as a CPOE (Certificate of Proof of Operational Effectiveness) — a W3C Verifiable Credential with an Ed25519 signature. Your scanner says PASS, Corsair signs \"the scanner said PASS.\" The tool's finding, signed, verifiable. A CPOE is: - Machine-readable — structured JSON, not a PDF - Cryptographically verifiable — Ed25519 signature, anyone can check - Provenance-tracked — records who produced the evidence, not just what it says Anyone can verify a CPOE. Free to check. No account required. Four steps with any JWT library. --- Quick Start --- Production Environment Variables Variable Purpose Required :-- :-- :-- DATABASE URL Postgres connection string for persistence Yes (server) CORSAIR KEY ENCRYPTION SECRET 32-byte key for AES-256-GCM signing key encryption (64 hex chars or base64) Yes (server) CORSAIR API KEYS Comma-separated API keys for authenticated endpoints Yes (prod, unless OIDC is configured) CORSAIR OIDC CONFIG JSON config for OIDC issuers (keyless signing) No CORSAIR DOMAIN Publ","default_branch":null,"files":null,"tree":[],"storefront":"/r/grcorsair","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/grcorsair/corsair/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}