Cloud Compliance Scanner Web Platform

Productivity

A web platform for security and compliance scans of your own cloud accounts, with results in one place; runs on your own machine with Docker Compose, all ports bound to 127.0.0.1. Derived from a frozen snapshot of an Apache-2.0-licensed open-source project.

Subscribe & download See how to start

SubscriptionUS$49 per month

Last run2026-11-13

In practice

Readiness4 / 5

What you need

Few changes needed4 / 5

Who it is for

Engineering and security teams who want to run security and compliance scans of their cloud accounts from a web interface on their own machine; scanning needs credentials for the cloud you scan.

How to start

$ sh scripts/quickstart/init-env.sh
$ docker compose up -d

Browse the files

Files in the product repository at the pinned commit. A few house files are left out of the zip.

File overview2,000+ paths

▸api24

.env.example
AGENTS.md
CHANGELOG.md
Dockerfile
README.md
changelog.d/
docker-entrypoint.sh
docs/
pyproject.toml
src/
…

▸claude_plugins4

prowler/

▸contrib48

PowerBI/
aws/
gcp/
inventory-graph/
k8s/
other-contrib/
reverse-proxy/
terraform-kickstarter/
wazuh/

▸dashboard121

__init__.py
__main__.py
assets/
common_methods.py
compliance/
config.py
lib/
pages/
src/
tailwind.config.js

▸docs608

.mintlifyignore
AGENTS.md
README.md
changelog.mdx
developer-guide/
dockerhub/
docs.json
favicon.ico
getting-started/
images/
…

▸examples9

output/
sdk/

▸kubernetes4

job.yaml
prowler-role.yaml
prowler-rolebinding.yaml
prowler-sa.yaml

▸mcp_server45

.dockerignore
.env.template
AGENTS.md
CHANGELOG.md
Dockerfile
README.md
changelog.d/
entrypoint.sh
prowler_mcp_server/
pyproject.toml
…

▸permissions14

prowler-additions-policy.json
prowler-azure-custom-role.json
templates/

▸prowler314

AGENTS.md
CHANGELOG.md
__init__.py
__main__.py
changelog.d/
compliance/
config/
exceptions/
lib/
providers/
…

▸scripts5

check_test_init_files.py
development/
quickstart/
setup-git-hooks.sh
validate_ocsf_output.py

▸skills105

README.md
ai-sdk-5/
django-drf/
django-migration-psql/
gh-aw/
jsonapi/
nextjs-16/
playwright/
postgresql-indexing/
prowler-api/
…

▸tests118

config/
conftest.py
contrib/
dashboard/
github/
lib/
providers/
util/

▸ui500

.dockerignore
.gitignore
.nvmrc
.pre-commit-config.yaml
.prettierignore
.prettierrc.json
.vscode/
AGENTS.md
CHANGELOG.md
Dockerfile
…

▸util13

__init__.py
check_yanked_pins.py
prowler-bulk-provisioning/
prowler_check_kreator/
replicate_pypi_package.py
update_aws_services_regions.py
update_oci_regions.py

▫AGENTS.md

▫ATTRIBUTION.md

▫CODE_OF_CONDUCT.md

▫CONTRIBUTING.md

▫Dockerfile

▫LICENSE

▫Makefile

▫PRODUCT.md

▫QUICKSTART.md

▫README.md

▫SECURITY.md

▫SECURITY.upstream.md

▫action.yml

▫codecov.yml

▫delivery-manifest.txt

▫docker-compose-dev.yml

▫docker-compose.yml

▫osv-scanner.toml

▫prowler-cli.py

▫pyproject.toml

▫uv.lock

▫Config and hidden files 47

Latest passing run

Clone → Checkout → Toolchain → Run platform

Pre-purchase Disclosure

What you are buying

A web platform for running security and compliance scans of your own cloud accounts and viewing the results in one place: brought up with Docker Compose on your own machine.

Derived from an open-source project under the Apache-2.0 licence, and not the original project itself.

Delivery is a frozen snapshot: one zip, taken from the product repository at revision 4589f9c.

Known limitations

The web app and API are bound to ports 3000 and 8080 on the local machine (127.0.0.1) only
Scanning needs your own keys and credentials for the cloud you scan; without them no scan can run
Data is kept in Docker volumes; down -v deletes it
The first start pulls images and migrates the database, which can take several minutes
The graph database is set to roughly 1G of memory each for heap and page cache, so Docker needs enough memory
Dependency licences were not scanned package by package
Pinned to the delivered snapshot; it does not follow upstream.

The liability cap, the scope of what is promised and the statutory floor are governed by the Terms of Service.

Vetting record

Everything below was checked against the pinned commit 163343b. Every verdict carries its full reasoning, an evidence link and the checker; failures are published, not hidden — do not take our word for it, verify it yourself.

2 PASS3 WARN0 FAIL

Source ReviewWARN

Read: docker-compose.yml, .env.example, QUICKSTART.md, scripts/quickstart/init-env.sh, LICENSE, ATTRIBUTION.md and PRODUCT.md. The application source (Python API and frontend) was not read file by file.

Script SafetyPASS

The compose file and init-env.sh were read: images are pinned by digest, and init-env.sh only writes a local .env with random values using openssl. Upstream scripts and the application code were not read.

RecencyWARN

This is a frozen snapshot that does not follow upstream. The date of the pinned upstream commit and recent upstream activity were not checked.

LicensePASS

SPDX:Apache-2.0

The LICENSE file in the product repository is the Apache-2.0 text. The upstream copy was not compared against it.

Dependency LicensesWARN

Dependencies are fetched inside the third-party images and from package registries. They were not scanned for licenses.