| What it does | Evidence collection for security fixes in your GitHub repo
| Open-source CI/CD observability platform for monitoring software delivery pipelines
|
|---|
| Stage | Not given
| Not given
|
|---|
| Founded | Not given
| Not given
|
|---|
| Based in | DE
| FR
|
|---|
| Pricing model | Freemium
| Freemium
|
|---|
| Pricing | Free GitHub Action (MIT license). fixdossier Pro: €69 one-time founding licence (tax included via Dodo Payments, no recurring annual fee) for first 50 GitHub Organizations, includes 1 GitHub organization, up to 3 repositories/products, up to 5 reviewers, up to 24 Final Evidence Packs per year, 60 Dr
| Community: Free forever (open-source, self-hosted). Cloud: €20/month (managed service, 14-day free trial). Pro: €200/month (self-hosted with professional support). All prices exclude VAT and are billed per organization.
|
|---|
| Key features | - Collects security-fix evidence from releases, tags, GitHub security advisories, Dependabot/Renovate PRs, and commits
- Generates dated fix record with transparent mapping methods
- Creates machine-readable JSON output (fixdossier/v1 schema)
- Generates support policy with security support dates per release
- Pro: OIDC CI ingestion with zero long-lived repository secrets
- Pro: Human sign-off with append-only review ledger and reviewer attribution
- Pro: Export Ed25519-signed Evidence Packs as PDF and ZIP
- Runs on every release and weekly with default GITHUB_TOKEN
- Notes permission gaps instead of failing the run
| - Event collection from GitHub, GitLab, Jenkins, Kubernetes, ArgoCD and 20+ sources
- DORA metrics dashboards with deployment frequency, lead time, time to restore, and change failure rate
- Artifact timeline showing which version is deployed where and when
- Pipeline and test run monitoring with flaky test detection
- Incidents and tickets tracking with time-to-restore metrics
- PostgreSQL and TimescaleDB storage with plain SQL querying
- Event-driven automation via HTTP, NATS, or Kafka sinks
- Customizable Grafana dashboards for team workflow
- Cross-repository pipeline visibility across all CI/CD tools
- CDEvents standard-based event normalization with no vendor lock-in
|
|---|
| What makes it different | - MIT-licensed free tool with transparent mapping methods showing how each fix was identified
- Generates support periods and compliance-ready evidence for EU Product Liability and Cyber Resilience regulations
- Pro: Ed25519-signed, verifiable Evidence Packs with full audit trails for customer questionnaires and archives
- Reads advisory patched_versions ranges for precise version mapping without keyword guessing
| - Built on open CDEvents standard with both push and pull data collection, not proprietary APIs
- Full data ownership with self-hosted option storing events in your own PostgreSQL
- Open-source with Apache 2.0 license and no lock-in, keeping access to components even after canceling
- Works with existing tools without requiring workflow changes
- Same event stream powers both dashboards and downstream workflow automation
|
|---|
| Community votes | 0 | 0 |
|---|
| DR (Domain Rating by Ahrefs) | Not checked yet ● no change since last check | 10 ● no change since last check |
|---|
| Trust Flow (Majestic) | 0 | 7 |
|---|
| Citation Flow (Majestic) | 12 | 27 |
|---|
| Referring domains (Majestic) | 2 | 20 |
|---|
CDviz