// screenshots
See It From the Inside
The Config UI is where the platform surfaces its work — normalized findings from five scanners in one view, triaged by severity, scanner, and repository.
$ cat project.yaml
name: Baghguard
type: Security Scanning Platform
stack:
- Python · PostgreSQL
- Kubernetes · Argo CD
- Terraform · Terragrunt · AWS
scanners:
- Trivy · Grype · Gitleaks · Checkov · OPA
status: ● active development_
GitOps-native security scanning for Kubernetes
// overview
Baghguard is a GitOps-native security scanning platform that plugs straight into a CI/CD pipeline. A webhook receiver validates incoming GitHub HMAC signatures, then triggers a Kubernetes Job that runs a battery of industry-standard scanners across the repository — no bolted-on SaaS dashboard, no manual triggering.
Every scanner's output gets normalized into a unified schema and stored in Postgres, so findings from five different tools show up in one consistent format. Critical findings are pushed straight to Slack and email — the team hears about a problem before it ships, not after.
// architecture
Python microservices built on the standard library's http.server — no framework overhead. A webhook receiver, normalizer, Slack/email alerters, and a Config UI with GitHub OAuth login, each with its own Dockerfile and requirements.txt.
Trivy for CVEs and IaC scanning, Grype for dependency vulnerabilities, Gitleaks for secret detection, Checkov for Terraform misconfigurations, and OPA for policy enforcement — each running as its own Kubernetes Job.
Kubernetes manifests deployed via Argo CD, running locally on a kind cluster for development. Terraform managed through Terragrunt provisions the AWS side — VPC, EKS for prod, RDS Postgres, S3, and ECR — with remote state split across dev and prod.
A custom GitHub Action — pipelineguard-action — aggregates scanner results in Python so any other repository's pipeline can pull in Baghguard's findings without standing up the whole platform.
// screenshots
The Config UI is where the platform surfaces its work — normalized findings from five scanners in one view, triaged by severity, scanner, and repository.
// status
Baghguard is under active development — Python microservices, Kubernetes-native scanning, and GitOps deployment, all wired together to catch problems before they reach production.
Baghguard is built by Sitar Gold (also known online as Sitar Daniel) — a DevOps engineer and AWS Community Builder who spent four years in a Network Operations Center before moving into cloud engineering. She creates SDGOPS, hosts the SDGOPS Podcast on DevOps and cloud, and speaks at tech conferences.