Skip to content

Commit 1d3618c

Browse files
UlisesGasconUlisesGascon
authored
Merge pull request #17 from OpenPathfinder/docs/visionBoard-and-more
2 parents 9544001 + 3fa903c commit 1d3618c

24 files changed

+1166
-20
lines changed

‎docs/introduction/getting_started.md‎

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,3 +5,91 @@ slug: /getting-started
55
---
66

77
# Getting Started
8+
9+
Welcome to **OpenPathfinder**, a collaborative open source initiative that empowers developers and organizations to secure, monitor, and manage their projects efficiently. This guide introduces you to our two flagship tools, **VisionBoard** and **fortSphere**, and helps you begin your journey with OpenPathfinder.
10+
11+
---
12+
13+
![OpenPathfinder logo in header format](/img/openPathfinder_header.png)
14+
15+
## What Is OpenPathfinder?
16+
17+
OpenPathfinder is committed to building tools that:
18+
- Simplify compliance with security and operational standards.
19+
- Automate repetitive tasks, freeing up time for maintaining projects.
20+
- Provide actionable insights to maintain project health.
21+
22+
Our current projects:
23+
- **[VisionBoard](#visionboard)**: A dashboard for data-driven compliance and project monitoring.
24+
- **[fortSphere](#fortsphere)**: A CLI tool for secure policy management across GitHub organizations.
25+
26+
---
27+
28+
![visionBoard logo in header format](/img/visionBoard_header.png)
29+
30+
## VisionBoard
31+
32+
VisionBoard helps organizations transform raw data into actionable insights. [Created to support OpenJS Foundation projects](/docs/history), it simplifies the complex task of monitoring security and operational health.
33+
34+
### Key Features:
35+
- **Customizable [Checks](/docs/visionBoard/Checks) and [Checklists](/docs/visionBoard/checklists)**: Automates compliance with security standards, such as the [OpenJS Security Compliance Guide](/docs/visionBoard/checklists#official-checklists).
36+
- **Integration with Tools**: Connects to GitHub APIs, OSSF Scorecard, and other external sources to enrich and analyze data.
37+
- **Intuitive Dashboards**: Offers visual insights into the state of your projects.
38+
39+
VisionBoard is the go-to tool for organizations aiming to maintain compliance and ensure best practices across their repositories. Explore more on the [VisionBoard page](/docs/visionBoard).
40+
41+
---
42+
43+
![fortSphere logo in header format](/img/fortSphere_header.png)
44+
45+
## fortSphere
46+
47+
fortSphere is a CLI tool that simplifies managing policies for GitHub organizations and repositories. Designed by maintainers, for maintainers, it ensures efficiency and security without compromising user control.
48+
49+
### Key Features:
50+
- **Local Processing**: All operations are executed locally—your sensitive data never leaves your machine.
51+
- **Policy Management**: Detects and resolves non-compliant configurations with predefined or custom [policies](/docs/fortSphere/policies).
52+
- **Real-Time Updates**: Provides instant feedback and remediation to secure your repositories.
53+
54+
---
55+
56+
## Why Use OpenPathfinder?
57+
58+
By combining VisionBoard and fortSphere, OpenPathfinder offers:
59+
- **Comprehensive Solutions**: Address both compliance monitoring and secure policy enforcement.
60+
- **Flexibility**: Use these tools independently or as part of an integrated workflow.
61+
- **Community Focus**: Built collaboratively with a focus on practical needs.
62+
63+
---
64+
65+
## Get Started
66+
67+
1. **Learn More**:
68+
- Dive into the [VisionBoard Overview](/docs/visionBoard) or [fortSphere Overview](/docs/fortSphere).
69+
70+
2. **Join the Community**:
71+
- Participate in discussions, explore issues, and contribute on [GitHub](https://github.com/OpenPathfinder).
72+
73+
3. **Run Locally**:
74+
If you prefer to start exploring the tools locally, use the following `docker-compose.yml` file:
75+
76+
```yml
77+
# soon
78+
```
79+
80+
### Commands
81+
- **Start the services**:
82+
```bash
83+
docker compose up
84+
```
85+
86+
- **Stop and remove the services**:
87+
```bash
88+
docker compose down
89+
```
90+
91+
This setup allows you to explore VisionBoard’s dashboard and fortSphere’s CLI in a local environment.
92+
93+
---
94+
95+
Thank you for choosing OpenPathfinder. Together, we’re fortifying the future of open source development!

‎docs/introduction/history.md‎

Lines changed: 173 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,173 @@
1+
---
2+
sidebar_position: 4
3+
title: History
4+
slug: /history
5+
---
6+
7+
# History of OpenPathfinder
8+
9+
At OpenPathfinder, we believe that open source collaboration drives innovation and empowers communities to build sustainable solutions. Here’s how our journey began and evolved over time.
10+
11+
---
12+
13+
OpenPathfinder emerged from a collective commitment to enhance the management and security of open source projects. It began as an initiative within the OpenJS Foundation's [Security Collaboration Space](https://github.com/openjs-foundation/security-collab-space), a forum dedicated to governing the security progress of JavaScript ecosystem projects.
14+
15+
Initially, the team envisioned a "dashboard"—a dynamic tool to visualize the progress of projects adhering to the principles of the ["OpenJS Foundation Security Compliance Guide v1.0"](https://docs.google.com/document/d/1tvJYtptFXqvS4863dhPwoVmFT5Jwr_WZLralrnulCZs/edit?tab=t.0#heading=h.2waouzm4ry8i). This guide served as a foundation for security compliance best practices, emphasizing the importance of equipping maintainers with tools to address complex security requirements effectively.
16+
17+
However, the team soon realized the potential to create a solution that transcended the limitations of a single ecosystem. This broadened the project’s scope into a platform capable of supporting diverse stacks and standards. The vision expanded from security compliance to improving the overall operational health of open source projects. Thus, OpenPathfinder was born—a universal solution designed to empower maintainers and foster sustainable project growth.
18+
19+
A key principle in OpenPathfinder's design is ensuring **security and autonomy**. Both **VisionBoard** and **fortSphere**, the core tools of the platform, are self-hosted. This approach guarantees data security and provides maintainers with full control over their workflows and tools, eliminating reliance on third-party hosting and mitigating associated vulnerabilities.
20+
21+
### Core Objectives of OpenPathfinder Tools:
22+
- Automate compliance with security and operational standards.
23+
- Deliver actionable insights for enhancing project health.
24+
- Enable seamless policy management across distributed repositories.
25+
26+
Built by maintainers for maintainers, OpenPathfinder embodies the spirit of collaboration, turning ambitious ideas into practical solutions that empower open source teams to thrive.
27+
28+
---
29+
30+
## Milestones
31+
32+
### 1. Initiate Development of Security Program Standards for OpenJS Projects (Feb 2024)
33+
34+
In February 2024, [the OpenJS Foundation's Security Collaboration Space](https://github.com/openjs-foundation/security-collab-space) embarked on an ambitious initiative to [Develop Security Program Standards for OpenJS Projects](https://github.com/openjs-foundation/security-collab-space/issues/150). This project aimed to establish a comprehensive framework of security checks and guidelines to strengthen the security posture of OpenJS projects.
35+
36+
Contributors conducted detailed analyses of existing standards and frameworks, ensuring the final program would address diverse maintainer needs while remaining actionable and effective. This collaborative effort resulted in a robust foundation for OpenPathfinder’s future tools and solutions.
37+
38+
Key documents and discussions that shaped this initiative include:
39+
- [Priority Group Index Page Options](https://hackmd.io/@rudd/H14K8eUuR): Explored ways to organize and prioritize security checks for accessibility.
40+
- [Categories Index Options](https://hackmd.io/@rudd/BkUM3WU_R): Focused on categorizing security standards for easier understanding and implementation.
41+
- [Priority Group Details Page Options](https://hackmd.io/@rudd/SyBtnZL_C): Discussed detailed layouts for presenting checks and recommendations.
42+
43+
This milestone established a foundation for building adaptable security frameworks, paving the way for OpenPathfinder’s comprehensive solutions.
44+
45+
---
46+
47+
### 2. Publish Draft of OpenJS Security Compliance Guide v1.0 (June 2024)
48+
49+
By June 2024, the OpenJS Foundation achieved a significant milestone: the publication of the draft for the **OpenJS Security Compliance Guide v1.0**. This guide offered detailed insights and tools to help maintainers align their projects with best practices in security compliance.
50+
51+
The draft included two key components:
52+
1. **A comprehensive checklist spreadsheet** outlining actionable security checks and requirements for maintainers.
53+
2. **A detailed guide** explaining how to apply these checks effectively to improve project security and operational health.
54+
55+
Key resources from this milestone:
56+
- [Issue #211 in Security Collaboration Space](https://github.com/openjs-foundation/security-collab-space/issues/211): Documented the progress and iterations of the compliance guide.
57+
- [Intro and Review of Standards](https://docs.google.com/document/d/1tvJYtptFXqvS4863dhPwoVmFT5Jwr_WZLralrnulCZs/edit): A foundational document summarizing the goals and framework of the compliance guide.
58+
- [Standards Checklist Spreadsheet](https://docs.google.com/spreadsheets/d/1GwIsAudAn89xv9DAbr1HUaY4KEVBsYfg--_1cW0uIB0/edit#gid=0): Detailed the list of checks maintainers could follow for compliance.
59+
60+
#### Highlight: Interactive Introduction to the Compliance Guide
61+
62+
<iframe
63+
width="560"
64+
height="315"
65+
src="https://www.youtube.com/embed/ZjmpNIYpvnc"
66+
title="Overview of OpenJS Security Compliance Guide v1.0"
67+
frameborder="0"
68+
allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture"
69+
allowfullscreen>
70+
</iframe>
71+
72+
This milestone marked a turning point, providing maintainers with actionable tools and a roadmap to navigate complex security landscapes effectively. The feedback and testing phases that followed refined the guide, ensuring its practical application across diverse open source projects.
73+
74+
---
75+
76+
### 3. Website Launch (July 2024)
77+
78+
While the original documents served as a strong foundation for discussion and feedback, they posed challenges for maintainers. The format required high familiarity with the compliance guide and was difficult to operationalize. To address these challenges, the team decided to build a website using **Docusaurus** to centralize and better organize the information for maintainers.
79+
80+
The website grouped all the compliance information in an intuitive and accessible way, making it easier for maintainers to navigate and implement the guidelines. During this stage, the team synchronized updates with the original documents, incorporating community feedback in real-time.
81+
82+
<iframe
83+
width="560"
84+
height="315"
85+
src="https://www.youtube.com/embed/GUqsDqZMEec?si=G2PCVsqW5LLL6emc&amp;start=2471"
86+
title="Overview of OpenJS Security Compliance Guide v1.0"
87+
frameborder="0"
88+
allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture"
89+
allowfullscreen>
90+
</iframe>
91+
92+
93+
94+
95+
The website was deployed on Netlify and is available at: [OpenJS Security Program Standards](https://openjs-security-program-standards.netlify.app/).
96+
97+
This launch was a pivotal moment, transforming the compliance guide from a static resource into an interactive and dynamic tool that maintainers could easily use and refer to in their workflows.
98+
99+
---
100+
101+
### 4. The "Dashboard" POC (November 2024)
102+
103+
In the last quarter of 2024, thanks to support from [Alpha-Omega](https://alpha-omega.dev/), the team initiated the development of the "Dashboard" Proof of Concept (POC)—a long-discussed idea from earlier in the year. The goal was to build a basic POC within a few days to demonstrate how maintainers could efficiently analyze, understand, and address security issues.
104+
105+
The POC leveraged local file storage, a CLI interface, and basic reporting and alert mechanisms using Markdown/JSON formats. It served as a proof of value, showing how this project could positively impact maintainers' daily workflows by streamlining security issue management.
106+
107+
### Key Achievements:
108+
- Successfully integrated external sources such as the GitHub API and the OSSF Scorecard.
109+
- Analyzed data against predefined compliance checks from the guide.
110+
- Showcased project progression using simple but effective visualizations.
111+
112+
#### Highlight: Full Demo of the Dashboard
113+
114+
<iframe
115+
width="560"
116+
height="315"
117+
src="https://www.youtube.com/embed/B1kd8k5SvBI"
118+
title="Dashboard Proof of Concept Demo"
119+
frameborder="0"
120+
allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture"
121+
allowfullscreen>
122+
</iframe>
123+
124+
Key Resources:
125+
- **Slides**: [Presentation](https://slides.ulisesgascon.com/openjs-security-program-standards)
126+
- **Code Repository**: [GitHub POC Code](https://github.com/UlisesGascon/poc-openjs-security-program-standards-dashboard)
127+
128+
This milestone demonstrated the potential impact of the dashboard in simplifying security workflows, inspiring further iterations and community collaboration.
129+
130+
---
131+
132+
### 5. OpenPathfinder and VisionBoard (December 2024)
133+
134+
Following the success of the Dashboard POC, the team decided to formalize and expand its efforts. This led to the development of **[VisionBoard](/docs/visionBoard)**, the flagship tool under the broader [OpenPathfinder](https://openpathfinder.com/) initiative. [VisionBoard](/docs/visionBoard) aims to support maintainers with:
135+
- Comprehensive compliance monitoring for multiple security guidelines or checklists.
136+
- An extensible architecture for integration with various ecosystems and tools.
137+
- Enhanced user interfaces designed for maintainers of all experience levels.
138+
139+
To establish [OpenPathfinder](https://openpathfinder.com/) as an independent and scalable initiative, the team secured branding assets, including logos and domain names, while organizing the first contributors' meeting. This marked the beginning of VisionBoard's transition into a community-driven platform.
140+
141+
Key Resources:
142+
- **Slides**: (Coming Soon)
143+
- **Recording**: (Coming Soon)
144+
145+
---
146+
147+
### 6. fortSphere (December 2024)
148+
149+
While [VisionBoard](/docs/visionBoard) excelled at providing insights into compliance, the team identified a critical gap: simplifying and accelerating the mitigation of security issues. To address this, they developed **[fortSphere](/docs/fortSphere)**, a CLI tool designed to:
150+
- Apply security policies at the organization or repository level on GitHub.
151+
- Streamline changes that typically require significant time and manual effort.
152+
- Reduce the Time to Mitigation (TTM), especially for maintainers managing hundreds of repositories.
153+
154+
[fortSphere](/docs/fortSphere) integrates seamlessly into existing workflows, making it an indispensable tool for maintainers aiming to achieve security compliance efficiently.
155+
156+
Key Features:
157+
- Centralized policy management for GitHub.
158+
- A library of predefined [policies](/docs/fortSphere/policies) tailored to common security needs.
159+
- Secure local operations for enhanced control and privacy.
160+
161+
162+
## Our Future
163+
164+
As OpenPathfinder evolves, we remain committed to:
165+
- Expanding our toolset with new features and integrations.
166+
- Engaging the open source community to drive innovation.
167+
- Building a more secure and collaborative ecosystem for maintainers and developers.
168+
169+
We invite you to join us on this journey. Whether you’re a contributor, a maintainer, or simply curious about our projects, OpenPathfinder welcomes you to help shape the future of open source.
170+
171+
---
172+
173+
Thank you for being part of our story!

‎docs/projects/fortSphere/about.md‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5,17 +5,19 @@ slug: /fortSphere
55
---
66

77

8-
![fortSphere logo and tagline, 'Fortify your Digital Sphere, One Command at a Time](/img/fortSphere_header.png)
98

109
# fortSphere
1110

1211
Fortify your Digital Sphere, one command at a time
1312

1413
---
1514

16-
**fortSphere** is a community-driven, open-source CLI tool crafted with love by maintainers for maintainers. It empowers you to secure and streamline your GitHub organizations and repositories, ensuring you’re always in control. Built with a secure-by-default philosophy, fortSphere guarantees that:
15+
![fortSphere logo and tagline, 'Fortify your Digital Sphere, One Command at a Time](/img/fortSphere_header.png)
16+
17+
18+
**fortSphere** is a community-driven, open source CLI tool crafted with love by maintainers for maintainers. It empowers you to secure and streamline your GitHub organizations and repositories, ensuring you’re always in control. Built with a secure-by-default philosophy, fortSphere guarantees that:
1719
- **Your Tokens and Data Stay Local:** All operations are performed locally—your sensitive information never leaves your machine.
18-
- **No Blind Trust Required:** As an open-source project, you don’t need to trust others—just the transparent and collaborative efforts of its contributors.
20+
- **No Blind Trust Required:** As an open source project, you don’t need to trust others—just the transparent and collaborative efforts of its contributors.
1921

2022
---
2123

‎docs/projects/visionBoard/about.md‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
---
2+
sidebar_position: 1
3+
title: About
4+
slug: /visionBoard
5+
---
6+
7+
# VisionBoard
8+
9+
Transforming Data into Actionable Insights
10+
11+
---
12+
13+
![visionBoard logo and tagline, 'Transforming Data into Actionable Insights](/img/visionBoard_header.png)
14+
15+
**visionBoard** helps organizations transform raw data into actionable insights. [Created to support OpenJS Foundation projects](/docs/history), it simplifies the complex task of monitoring security and operational health.
16+
17+
---
18+
19+
## Key Features:
20+
21+
- **Customizable [Checks](/docs/visionBoard/Checks) and [Checklists](/docs/visionBoard/checklists)**: Automates compliance with security standards, such as the [OpenJS Security Compliance Guide](/docs/visionBoard/checklists#official-checklists). Offers flexibility to define checks tailored to your project needs.
22+
- **Integration with Tools**: Connects to GitHub APIs, OSSF Scorecard, and other external sources to enrich and analyze data. This ensures up-to-date and comprehensive insights.
23+
- **Intuitive Dashboards**: Offers visual insights into the state of your projects, making it easier to identify trends, risks, and areas for improvement.
24+
25+
---
26+
27+
## Demo Walkthrough
28+
29+
Explore VisionBoard in action:
30+
31+
1. **Monitor a Repository**: Learn how VisionBoard automates compliance checks for a GitHub repository.
32+
2. **Analyze Results**: View insights from dashboards and reports generated by the system.
33+
3. **Resolve Issues**: Identify actionable steps to improve security and compliance.
34+
35+
*Coming soon: A detailed walkthrough video!*
36+
37+
---
38+
39+
## Why visionBoard?
40+
41+
VisionBoard helps organizations:
42+
43+
- **Monitor Security and Health**: Track key metrics across repositories to ensure compliance and identify vulnerabilities in real time.
44+
- **Automate Compliance**: Run predefined checks that align with industry standards, reducing manual effort and errors.
45+
- **Save Time**: Generate actionable insights with minimal configuration, allowing teams to focus on critical tasks.
46+
47+
**Example Use Case**:
48+
49+
A team managing multiple open-source repositories uses VisionBoard to track branch protection settings and detect vulnerabilities across projects, reducing the time spent on manual reviews.
50+
51+
---
52+
53+
Ready to transform your data into actionable insights? Explore our [Getting Started Guide](/docs/visionBoard/installation).

0 commit comments

Comments
 (0)