Draugr

Developer-first, descriptor-driven security and compliance qualification.

Describe your app. Draugr figures out the rest.

You declare what you know about your software — where the repos are, what container images it builds, what endpoints it exposes, what infrastructure it runs on — in a single descriptor (draugr.saga.yaml). Draugr infers which checks apply, runs the right tool for each, and produces pass/fail evidence you can trust. Swap scanners freely — use the tools you already pay for, or Draugr's open-source defaults. Every finding is normalized to SARIF.

Both questions asked before a release ships, from the same descriptor and the same gate: the security one — SAST, SCA, secrets, IaC, DAST, TLS, headers — and the compliance one, starting with a Software Bill of Materials of everything you actually ship.

This is the open-source core engine.

Quickstart · See it in action · Status · Use in CI · From an AI assistant · Documentation · What Draugr doesn't promise · Security · Development

See it in action

The verdict, priorities and severities are color-coded on a terminal (disable with NO_COLOR). Findings are ranked by priority (P1–P4) = severity × the component's exposure & criticality; severity (critical/high/medium/low) comes from the CVSS score when a scanner provides one, else from the finding's level. The gate and --format json/sarif still use SARIF levels.

draugr-dev/draugr-demo is an intentionally vulnerable sample app wired to Draugr. Every control lights up, the findings are prioritized P1–P4, and results land in the repo's Security → Code scanning tab — a safe sandbox to see exactly what Draugr delivers before pointing it at your own code. The example PRs there also show the new-vs-fixed PR diff and the sticky comment.

Status

🚧 Early, and moving fast. Working today: