A community-centric software security platform

Minder Cloud is for open source developers and communities who want to better secure their projects and protect them from malicious attacks. It provides an alternative to developers and communities who prefer to use and support open source tools to keep their projects safe. Unlike traditional security platforms, Minder Cloud takes a more holistic approach to addressing supply chain security, focusing on risk factors beyond CVEs in the SDLC that can leave projects vulnerable to software quality and security issues and impact downstream adoption.

Minder Cloud is Stacklok’s fully managed version of Minder, an open source security platform. It provides an alternative for open source developers and communities who do not want to run and manage their own Minder server. 

Minder Cloud includes the same features as the open source version, as well as a UI and other features for added security and ease of use, like managed policy templates and security insights.

Minder Cloud makes it easy to apply and continuously enforce security policies and best practices that keep your software delivery lifecycle safe—from your source code repos and open source dependencies to your CI/CD pipelines and build artifacts. It can also help you generate attestation statements to prove that your software was built in a secure way.

Because developers rely on open source to build their apps, malicious actors are increasingly using open source as an attack vector. This is leading to more scrutiny and government regulation of open source security. Open source maintainers and contributors are often volunteers, working nights and weekends on their projects. They don’t have extra time or dedicated security teams to continuously monitor the security of their projects and catch issues before they harm consumers and hinder adoption. 

Minder Cloud helps open source communities protect their projects, without needing to have deep security expertise or manage yet another platform. To do this, it provides managed policy templates with security best practices that project owners can easily apply across their SDLC to keep their projects safe. Once policies are applied, Minder will continuously monitor projects for issues, and can automatically remediate to fix issues before PRs are merged or artifacts are built.

Stacklok has committed to making Minder Cloud free forever for use on public repositories.

No. Minder Cloud actually makes it easier to adopt and comply with OpenSSF Scorecard standards, many of which are included in our managed policy templates. 

Yes. Minder integrates with GitHub’s built-in tools, CodeQL and Dependabot, respectively. Additionally, you can use Minder to check pull requests for dependencies with known vulnerabilities from the Open Source Vulnerabilities database. Beyond scanning for vulnerabilities, though, you can also use Minder’s Trusty integration to check PRs for dependencies that are known or suspected to be malicious or deprecated, or that don’t follow security best practices (for example, they haven’t been signed using sigstore). In the future, we plan to integrate with additional SAST and SCA tools.

Check out our documentation here!