The optional backend for Zagware Scanner and your GitHub org: scan history, suppression audit trails, CIS GitHub Benchmark compliance, and change-management evidence — plus the developer activity metrics your GitHub webhooks already carry, all from a single dashboard.
Connect a GitHub org in minutes. Webhook events flow in automatically, and scan results from Zagware Scanner (IaC, SCA, secrets) upload straight into the same dashboard — history, trend charts, and suppression audit trails sitting next to developer metrics and compliance.
| Repository | PRs merged | Cycle time | Contributors | Ticket coverage |
|---|---|---|---|---|
| git-tracking-platform | 9 | 0.9d | 2 | 88% |
| pr-gate | 6 | 1.2d | 1 | 100% |
| nono | 5 | 2.1d | 3 | 60% |
| pgbrowser | 3 | 0.6d | 1 | 33% |
⚠ 2 open policy violations · branch protection removed on api-gateway
Zagware Scanner findings and raw webhook events land in the same event-driven pipeline — ingestion, normalisation, metrics, and compliance, in one place.
IaC, SCA, and Secrets results from every Zagware Scanner run upload via /api/v1/{iac,sca,secrets}/upload — full scan history per repo, CVSS/EPSS/KEV context on every CVE, and validated-secret flags, queryable long after the PR comment scrolls away.
Every /zagware suppress comment or hand-edited suppressions.yaml entry is recorded — who, when, why, and category (IaC/SCA/Secrets) — independent of git history, for compliance review of which rules get suppressed too often.
A GitHub App receives signed webhook events from your org. Each POST is HMAC-SHA256 verified, archived raw to S3, and acknowledged in <20ms — nothing is dropped, even during downstream outages.
Provider-specific payloads are mapped to a single canonical Event schema: kind, actor, repository, and typed JSONB payload. Idempotent writes keyed on delivery ID make replays safe with no duplicate rows.
Commit counts, PR throughput, review activity, and comment frequency aggregated per-actor, per-repo, per-period. Daily, weekly, and monthly rollups are pre-computed and queryable over a REST API.
One row per PR with opened, first-reviewed, and merged timestamps. Jira keys, GitHub issue refs, and Azure DevOps refs are extracted from PR titles and bodies — giving you org-level ticket linkage across every repo at a glance.
On-demand compliance scans across 13 CIS GitHub Benchmark controls, with SOC-2 CC6 and CC8 mappings. Results are stored per-scan so you can track your security posture over time and catch regressions before they're reported.
Security-relevant events — branch protection changes, membership changes, repository visibility flips — trigger immediate live checks via the GitHub API. Violations are raised and auto-resolved as state changes, scoped per GitHub org.
Full user auth with email invite flow, bcrypt passwords, 7-day sliding sessions, and scoped API tokens. Three roles (owner, admin, member) per tenant. Platform admin controls span all tenants, with per-user and per-token audit trails.
The canonical schema and multi-tenant architecture are provider-agnostic from day one. GitLab and Bitbucket support follow the same integration pattern — only webhook auth and payload shapes differ. Both are planned for after the GitHub GA.
The SNS fan-out architecture lets new consumer apps subscribe without touching the ingestion pipeline. Metrics is the first. Alerting, cost attribution, AI-generated PR summaries, and cross-repo dependency graphs can be wired in independently.
PR→ticket linking, an exportable change-management evidence report (ticket, reviewer, separation-of-duties, CI status per merge), and quarterly access-review sign-off — mapped to SOC-2 CC6/CC8, built on data already flowing through the pipeline.
1
Click Connect in the dashboard and install the Zagware GitHub App on your org. GitHub redirects back with an installation ID and the platform links the installation to your tenant automatically.
2
GitHub sends signed webhook POSTs for every repo event — pushes, PRs, reviews, branch changes, membership updates. The Lambda receiver verifies the HMAC signature, archives the raw payload to S3, and acknowledges in <20ms with no data loss even if downstream is slow.
3
The ECS-based normaliser polls SQS, fetches each payload from S3, maps it to the canonical schema, and writes raw and canonical rows to Aurora PostgreSQL. Webhooks received before an installation is fully linked are queued and replayed automatically once it activates.
4
The metrics worker upserts actor stats, PR lifecycle rows, and repo throughput. Security-relevant events trigger live compliance checks in parallel — violations are created or auto-resolved within seconds of the event landing, scoped per connected GitHub org.
5
The React dashboard gives org-level, repo-level, and per-contributor views with period switching and a security compliance view. Every metric is also available over a REST API with Bearer token auth, accessible from CI, scripts, or any downstream tool.
Serverless at the edge, managed containers in the middle, Aurora at the core. Built for low operational overhead and clear cost scaling.
Webhook receiver runs as an arm64 Lambda — sub-20ms acknowledgement. Normaliser, metrics worker, and API run as long-lived ECS Fargate services, scalable to zero overnight.
Raw-events queue decouples Lambda from the normaliser. Canonical-events SNS topic fans out to all consumer queues. Adding a new app is a new SQS subscription, not a new pipeline.
PostgreSQL 16 · 0.5–4 ACU · scales to zero. Schema managed by goose migrations. Accessed only from private subnets and the SSM bastion; no public DB endpoint.
Vite build, React Router v6 SPA deployed to S3 and served through CloudFront. The same CloudFront distribution proxies /api/* to the ALB — no CORS configuration required.
All AWS infrastructure is managed by Terraform. CI runs Go tests with a live Postgres service container. Deploy workflows are manually triggered; dashboard deploys are automatic on push to main.
Transactional email for team invites and password resets from noreply@zagware.io. DKIM configured via Cloudflare. When SES is absent (local dev), invite tokens are returned directly in the API response.
Git Tracking Platform is in active development. Already running Zagware Scanner? Point ZAGWARE_PLATFORM_URL at it for scan history and audit trails. Get in touch to discuss early access or a deployment tailored to your team.