Open-source cybersecurity ecosystem for Europe and beyond.

10 integrated security platforms + 1 governance layer + 4-language SDK — built for NIS2 compliance, API security, incident response, threat intelligence, and AI-attack defence. Fully self-hosted. Zero vendor lock-in.

Status (May 2026): 10 platforms + SDK at v1.0.0 production. OpenScrub v1.0.0 shipped — kernel-level DDoS mitigation via XDP/eBPF, GoBGP blackhole routing, per-IP rate limiting, CITADEL WORM evidence. CyberPath v1.0.0 shipped — security training with Docker/Wasm labs, Ed25519-signed certifications, NIS2 Article 21(2)(g) evidence to CITADEL WORM, NIS2 Compass coverage API, multi-tenant isolation. SecureLab v1.0.0 shipped — attack simulation and detection validation, 15 built-in attack types, MITRE ATT&CK coverage maps, detection validation against OpenScrub + APIGuard + ThreatFlow, IRFlow integration. VertGuard v1.0.0 shipped — real-time AI-attack defence: prompt injection, C2PA media authenticity, AI threat feed, deepfake video/voice detection, Zoom/Teams/WebEx plugin scaffolding, Python ML layer (HuggingFace), 28 API endpoints, 54 docs, NIS3-ready. APIGuard updated with JWT multi-secret rotation, Redis sliding-window rate limiting, access token denylist, and trusted-proxy depth stripping. OpenCSIRT hardened: silent error elimination, outbox idempotency, CITADEL WORM emission on advisory publish, HMAC replay window fix.

Typed client libraries for Go, Python, TypeScript, and Rust — integrate with any opensecstack platform. v1.0.0 production.

// Go
client := opensecstack.NewAPIGuardClient(baseURL, apiKey)
scan, _ := client.CreateScan(ctx, "https://api.example.com/openapi.json")
findings, _ := client.GetFindings(ctx, scan.ID, opensecstack.GetFindingsOptions{Severity: "critical"})

# Python — pip install opensecstack-sdk
client = APIGuardClient(base_url, api_key=api_key)
scan = client.create_scan(spec_url="https://api.example.com/openapi.json")
findings = client.get_findings(scan["id"])

// TypeScript — Node 18+ and browser, zero external runtime dependencies
const client = new APIGuardClient({ baseURL, apiKey });
const scan = await client.createScan({ specUrl: "https://api.example.com/openapi.json" });
const findings = await client.getFindings(scan.id, { severity: "critical" });

// Rust — async-first with tokio + reqwest
let client = APIGuardClient::new(base_url, api_key);
let scan = client.create_scan("https://api.example.com/openapi.json").await?;
let findings = client.get_findings(&scan.id).await?;

Shared module: Argon2id + server-side pepper password hashing — byte-compatible PHC encoding across Go and Python via sdk/go/password and sdk/python-password.

→ sdk/go · sdk/python · sdk/typescript · sdk/rust

All platforms share typed SDK contracts and route governance-sensitive actions through CITADEL's 5-gate engine, with every decision committed to the tamper-evident WORM chain.

APIGuard ──────┐                                        ┌─ AuthN (session validity)
NIS2 Compass ──┤                                        ├─ AuthZ (RBAC permission)
ThreatFlow ────┤                                        ├─ NDS (separation of duties)
IRFlow ────────┼──► opensecstack/sdk ──► CITADEL ─────► ├─ AUGUR (behavioural heuristics)
OpenCSIRT ─────┤                           MARSHAL      └─ WORM (unconditional append)
VertGuard ─────┤                           engine              │
OpenScrub ─────┤                                               ▼
CyberPath ─────┤                                        ┌──────────┐
SecureLab ─────┘                                        │ WORM chain│ SHA-256 + SHA-512 + BLAKE3
                                                        │ Ed25519   │ (TripleHash)
                                                        │ anchors   │ every 100 entries
                                                        └──────────┘

Inter-service authentication:

• API clients → platforms: JWT HS256 Bearer tokens
• Platform → CITADEL: HMAC-SHA256 request signing with shared secret
• Platform → platform webhooks: HMAC-SHA256 with ±5 min replay window (X-Irflow-Signature, per-source secrets)

→ Full architecture and data-flow map

git clone https://github.com/opensecstack/opensecstack
cd opensecstack
cp deploy/.env.example deploy/.env   # fill in secrets
docker compose -f deploy/docker-compose.yml up -d

Kubernetes: deploy/k8s. Full topology (ports, network segments, secret distribution): docs/deployment-topology.md.

→ Full roadmap with quarterly milestones, ecosystem release tags, and honest caveats

v1.0.0 fits different deployments differently. Be honest about which bracket you're in before going live:

Full tier matrix with required controls, known gaps, and roadmap dates: docs/security-maturity.md.

NIST PQC standards finalised 2024. NIS3 (~2030-2032) likely mandates PQC migration. We're moving now, not when the deadline hits:

• v1.1 (2026-2027): crypto-agility schema (algorithm identifiers on every signature + hash)
• v2.0 (2028): hybrid Ed25519 + ML-DSA anchors
• v3.0 (2030): ML-DSA becomes default — aligned with NIS3 transposition
• v4.0 (2033): Ed25519 signing retired (historical verification retained)

→ docs/post-quantum-roadmap.md · ADR-011

The AGPL split is deliberate: governance infrastructure must remain open for its value to hold. Tools remain permissive so you can embed them freely in proprietary pipelines.

The ecosystem grows with the community. Three ways to contribute right now:

1. Extend VertGuard. Real ML model weights for video/voice detection, adversarial robustness benchmarks, and Zoom/Teams/WebEx SDK provisioning (OAuth token exchange) are open contributions.
2. Expand SecureLab's attack library. Add new attack types, improve MITRE ATT&CK coverage, or build detection adapters for new platforms. File an issue with label securelab-attack.
3. Deploy it and break it. File realistic-deployment issues — what broke, what docs misled, what metrics are missing. All 10 platforms are live; real-world findings across any of them are extremely valuable.

• Contributing guide
• Code of conduct
• Governance & maintainer structure
• Security disclosure policy
• GitHub Discussions
• Release process · Compatibility matrix · Deprecation policy

We prefer users find out from us, not from a surprise:

• IRFlow's action dispatcher is a dry-run stub in v1.0. Decisions are stored correctly; real dispatch wiring lands v1.2.
• CITADEL's /worm/verify does linear chain integrity; in-API anchor signature cross-check is v1.1.
• VIGIL cross-platform health monitor is design-stage only. Prometheus dashboards cover the gap today.
• Rust SDK CI is Linux-only until cross-compile toolchain on Windows runners stabilises.
• Phase 5 (pyramid-os, symphy-os, pyramid-mvno) is aspirational and depends on foundation backing + EU funding. Without those, ecosystem stabilises at 10-11 active platforms.

Full transparency in CITADEL § Known Limitations and each platform's ROADMAP.md.