SaaS security posture management for the SIEM-native era.

Aperio is an open-source SSPM that connects to your SaaS estate, surfaces posture risks and OAuth grants, and pushes normalized findings into the SIEM you already operate. The current main branch ships a Go/ConnectRPC API backed by Prisma/Postgres data, a Next.js operator console, an stdio MCP broker, an ingestion worker, an optional NATS JetStream event bus, and a durable SIEM dispatcher with adapters for Splunk HEC, Panther, Panopticon, Elasticsearch, Datadog Logs, generic webhooks, and JSON Lines files.

In practical terms, Aperio ingests connector events, evaluates detection rules, tracks user-granted OAuth apps (shadow IT) and domain-wide delegations, opens and dedupes findings, and fans canonical aperio.finding.v1 envelopes out to your SIEM destinations.

• Connector catalog — built-in support for GitHub, Slack, Google Workspace, Okta, 1Password, Microsoft 365, and Atlassian (Jira & Confluence), with encrypted credential storage (AES-256-GCM) and per-check toggles.
• Posture detection — public-repo detection (GitHub), MFA-disabled detection (Slack), and a deep Google Workspace pack covering external sharing, admin posture (super-admin 2SV, recovery emails), Gmail auto-forwarding / delegates / send-as, and the domain-wide-delegation allow-list.
• Shadow IT — per-user users.tokens.list scan that catalogs every third-party OAuth app users have authorized, with graduated risk scoring (CRITICAL/HIGH/MEDIUM/LOW) calibrated against Google scope sensitivity.
• Findings lifecycle — auto-resolution on next sync when the underlying signal disappears, evidence persistence, severity scoring, dedupe by stable key, and risk exceptions with compensating controls.
• SIEM fanout — durable outbox with adapters for Splunk HEC, Panther, Panopticon, Elasticsearch, Datadog Logs, generic webhooks, and JSON Lines file sinks. Canonical envelope aperio.finding.v1.
• Event contracts — protobuf-backed Aperio lifecycle envelopes wrapped in Cerebro-compatible EventEnvelope messages, with optional NATS JetStream publishing for ingestion, finding lifecycle, and claim fanout events.
• Remediation — real handlers for Okta (suspend, reset MFA) and Slack (revoke OAuth app); the rest are stubbed and pluggable.
• Operator console — Next.js app with dashboard, findings, apps, shadow IT, security graph, connectors, SIEM destinations, and admin pages. Full-text command palette, role-aware navigation, MFA enrollment.
• Agents and MCP — tenant-scoped agent runtime that creates AgentProposal rows requiring human approval before any provider-side write executes. An stdio MCP broker mirrors core task and SIEM actions over JSON-RPC for MCP-native clients.
• Multi-tenant by default — every entity is scoped to an Organization. Tenant isolation is enforced at the route, repository, and integration layer, with cross-tenant test coverage in internal/bootstrap/tenant_isolation_test.go.

            Operator console (Next.js)        MCP clients (stdio)
                       |                              |
                       v                              v
              Go/ConnectRPC API                 MCP broker
             (cmd/aperio, internal)            (apps/mcp)
                       |
        +-----------------------------+
        |              |              |
        v              v              v
   Connectors    Detection      SIEM dispatcher
  (GitHub,      rules +         (outbox worker)
   Slack,       findings              |
   Google,      lifecycle             v
   Okta,         |              Splunk / Panther /
   1Pass,        v              Panopticon / Elastic /
   M365,    Postgres           Datadog / Webhook / JSONL
   Atlassian)  (state)
                  |
                  v
          Optional NATS JetStream
       (Cerebro-compatible events)

The Go API is the single source of truth for connector, finding, admin, auth, and SIEM workflows. The ingestion worker pulls audit-log events into the same Postgres state store. The SIEM dispatcher reads the SiemDelivery outbox and ships each finding to every enabled destination with retry/backoff. When APERIO_EVENT_BUS=nats, Go and worker processes also publish validated protobuf lifecycle events to JetStream; otherwise publishing is a safe no-op. Credentials are encrypted at rest with AES-256-GCM via packages/security.

• Node.js 20+ (the repo targets the active LTS line).
• Go 1.25+ (for the ConnectRPC API in cmd/aperio).
• Docker (for local Postgres and NATS via docker-compose.yml) or any reachable Postgres 15+.
• npm 10+ (ships with Node 20).
• GNU Make (preinstalled on macOS and most Linux distros) to use the make targets below.

The fastest path uses the Makefile; run make help to see every target.

git clone https://github.com/writer/Aperio.git
cd Aperio
make setup                          # .env, deps, Postgres, migrations, and seed data
make dev                            # Go API on :4100 + Next.js console on :3000

DATABASE_URL in .env is the single source of truth for the local Postgres port: make publishes the docker-compose database on the port embedded there and hands the Go server a pgx-compatible DSN automatically (Prisma's ?schema=public is stripped and sslmode=disable is added for local connections).

Prefer to run each step yourself? The manual flow is equivalent:

git clone https://github.com/writer/Aperio.git
cd Aperio

docker compose up -d                # local Postgres on :5432
npm install
cp .env.example .env                # fill in local secrets before sharing
npm run db:generate
npx prisma migrate dev --schema packages/db/prisma/schema.prisma

# create your local .env (see Configuration below for the full reference)
cat > .env <<EOF
DATABASE_URL="postgresql://aperio:aperio@localhost:5432/aperio?schema=public"
APERIO_ENCRYPTION_KEY="base64:$(openssl rand -base64 32)"
APERIO_AUTH_SECRET="$(openssl rand -hex 32)"
APERIO_WEB_ORIGIN="http://localhost:3000"
NEXT_PUBLIC_CONNECT_API_BASE_URL="http://localhost:4100"
EOF

# start the API and the web console in two shells
npm run dev:connect                 # http://localhost:4100
npm run dev:web                     # http://localhost:3000

The first time you sign in, run the seed script to provision a demo organization, owner user, and example findings:

npx tsx scripts/seed.ts

Long-running pipelines run as separate processes. The event bus is optional; set APERIO_EVENT_BUS=nats to publish protobuf envelopes to the local NATS service started by npm run dev.

During the Go worker transition, the unsuffixed worker commands run the TypeScript parity/reference workers. Explicit :go commands are available for scoped transition smokes; they load local .env settings and derive a pgx-safe Postgres DSN with scripts/dev-config.mjs go-database-url, but they are not full replacements until a parity matrix proves cutover.

npm run worker:ingestion                 # TypeScript parity/reference ingestion worker
npm run worker:siem                      # TypeScript parity/reference SIEM dispatcher
npm run worker:ingestion:go -- -once -limit 1  # explicit Go transition smoke
npm run worker:siem:go -- -once -limit 1       # explicit Go transition smoke
npm run mcp:broker                       # stdio MCP server for agent clients

Aperio reads runtime configuration from environment variables. Create a .env file at the repository root (it is gitignored).

# 32-byte AES key, base64-encoded
echo -n "base64:$(openssl rand -base64 32)"

# 64-char hex auth secret
openssl rand -hex 32

The SIEM dispatcher writes a canonical aperio.finding.v1 envelope and adapts it to each destination:

Each delivery row is durable, retried with exponential backoff, and de-duplicated by finding ID + destination ID.

Every workflow below is also wrapped by the Makefile — run make help for the full list (make dev, make verify, make test, make migrate, and more). The underlying npm scripts remain available:

npm run dev:connect            # Go ConnectRPC API on :4100
npm run dev:web                # Next.js console on :3000
npm run worker:ingestion       # TypeScript parity/reference ingestion worker
npm run worker:siem            # TypeScript parity/reference SIEM dispatcher worker
npm run worker:ingestion:go    # explicit Go transition ingestion worker
npm run worker:siem:go         # explicit Go transition SIEM dispatcher worker
npm run mcp:broker             # stdio MCP broker
npm run build:web              # production Next.js build
npm run proto:lint             # Buf lint for protobuf contracts
npm run proto:check            # lint, regenerate, and verify generated code is current
npm run test:go                # Go unit tests for ConnectRPC service
npm run typecheck              # tsc --noEmit
npm run test:api               # node --test (tsx loader)
npm run verify                 # generate, typecheck, API tests, Prisma validate, Go/proto checks, production audit
npm run db:generate            # prisma generate
npm run db:validate            # prisma validate
npm run backup:check           # backup-readiness preflight
npm run audit:prod             # npm audit --omit=dev

Use the full preflight before opening a PR:

npm run verify

Production deployments should pair Aperio's process-local route limits with edge or load-balancer rate limiting. Ingestion and SIEM delivery both use database-backed queues so accepted events and outbound deliveries survive API restarts.

Aperio's API runtime is Go/ConnectRPC. Native RPCs serve first-class read paths, and the CallApi compatibility RPC preserves the existing /api/v1/* web contract while remaining REST-shaped workflows are promoted into typed RPCs.

The web app talks to the Go API through NEXT_PUBLIC_CONNECT_API_BASE_URL, for example:

DATABASE_URL=postgresql://aperio:aperio@localhost:5432/aperio npm run dev:connect
NEXT_PUBLIC_CONNECT_API_BASE_URL=http://localhost:4100 npm run dev:web

Authentication uses the aperio_session HttpOnly cookie and the user_sessions table. The Go service validates the cookie token hash directly in Postgres and only reflects the configured APERIO_WEB_ORIGIN for credentialed browser calls.

Protobuf contracts follow Cerebro-style Buf conventions:

npm run proto:lint
npm run proto:check
npm run test:go

Event contracts live in proto/aperio/contracts/v1/events.proto and are encoded from packages/shared/src/protobuf-contracts.ts and internal/bootstrap/event_bus.go. Producers validate required envelope attributes before publishing so consumers can filter by schema, kind, tenant, finding, delivery, or job id without decoding every payload.

Native Go-backed RPCs live under ConnectRPC procedure paths such as /aperio.v1.AperioService/GetDashboardMetrics. The web console still uses REST-shaped /api/v1/* compatibility paths through the CallApi RPC while those workflows move to typed RPCs. Key compatibility groups:

The MCP broker (apps/mcp/src/server.ts) exposes a JSON-RPC superset of the task and SIEM surfaces for agent clients.

aperio/
├── apps/
│   ├── mcp/                # stdio MCP broker
│   └── web/                # Next.js operator console
├── cmd/aperio/             # Go ConnectRPC server entrypoint
├── gen/                    # Generated Go protobuf/ConnectRPC code
├── internal/               # Go service config and bootstrap packages
├── packages/
│   ├── connect/            # TypeScript ConnectRPC client and generated contracts
│   ├── db/                 # Prisma schema and client
│   ├── security/           # AES-256-GCM helpers and password hashing
│   └── shared/             # Zod schemas, connector catalog, SIEM catalog
├── proto/                  # ConnectRPC API + Cerebro-compatible event contracts
├── workers/                # ingestion + SIEM background workers
├── scripts/                # dev orchestration, seed, and operational scripts
├── tests/                  # node --test suites
├── droid-wiki/             # generated architecture and reference docs
└── docker-compose.yml      # local Postgres

The droid-wiki/ directory contains generated documentation. Useful entry points:

MIT — see LICENSE.