Prowler
live
A defense-in-depth project securing every layer of a real, running system: Prowler remediated all 19 findings across AWS, GCP, and Azure (verified by re-scan), the live dashboard runs 24/7 on Cloud Run reachable only through Cloudflare's CDN, proxy, and WAF, every change clears automated gates spanning supply-chain, SAST, secrets, IaC, and container scanning, and the AI tool that built it ran sandboxed with egress allowlisting. The supply-chain layer is the part worth noticing: it blocks malicious packages, not just vulnerable ones.
prowler.cloudsecuritypractice.com
Click to launch POC
↗
LoonVault
beta
A secure cloud data platform mapped control-by-control to the OSFI B-13 cyber-risk framework, with a working STRIDE threat model: a least-privilege AWS stack in ca-central-1 fronted by Cloudflare (WAF, rate-limiting), with RDS IAM auth and no stored credentials, private no-NAT subnets, customer-managed encryption, a region-lock SCP defined as code, and org-wide CloudTrail. The full data path (API Gateway → authorizer → Lambda → RDS) is built and validated end-to-end. The centerpiece is policy-as-code: an OPA-on-plan gate runs 20 tests against every Terraform change before deploy, blocking open SSH, public buckets, or out-of-region resources, each rule tied to the OSFI principle it enforces so compliance evidence can't drift from the code. Next: detection-and-response, wiring Prowler and the remaining rules onto the same control map.
loonvault.cloudsecuritypractice.com
Click to launch POC
↗