Evidence workflow
Automation finds clues.
People make the case.
Use the open-source Rust CLI to inspect a repository or GitHub organization. Continue with a 22-entry assessment that preserves provenance, boundaries, evidence, ownership, and follow-up—without pretending the result is one number.
The boundary
Evidence is not certification.
A checked-in security policy is useful evidence. It is not proof that the application fails closed. A missing file may also be legitimate when approved evidence lives elsewhere. The tool keeps those facts visible and leaves the contextual conclusion to accountable reviewers.
A small workflow
From checkout to evidence record
- 01
Audit the repository
The scanner covers every factor. It marks observable repository cues as leads and keeps runtime properties such as disposability and bounded concurrency in manual review.
cargo install --git https://github.com/22-factor-apps/22-factor-apps-audit --locked twenty-two audit repo . - 02
Inspect the organization
Read-only GitHub checks review source-portfolio, repository context, common security policy, checked-in automation, and ownership signals.
twenty-two audit org your-organization --format json - 03
Create the assessment
Initialization consumes the catalog generated from the same Markdown documents as this site. The output pins the edition and source release.
twenty-two assessment init --target github.com/your-org/your-app --output assessment.json twenty-two assessment validate assessment.json
Versioned artifacts
Portable by default
No account, browser state, or telemetry is required. Keep the JSON beside source, attach it to a release, or store it in your evidence system.