The Problem Nobody Talks About
In every organisation I've worked with, there's an invisible wall between developers and DevSecOps. The symptoms are familiar:
- DevSecOps raises security issues. Developers don't understand the urgency.
- Developers need deployment help. DevSecOps doesn't understand the code.
- Security scans block releases. Features get delayed. Customers get frustrated.
- Nobody knows which repositories are active, retired, or abandoned.
- "Who owns this service?" is a 30-minute investigation.
The Real Issue: No Single Source of Truth
Most organisations have 50-500+ repositories. Each one has:
But this information lives in different systems. When you need to answer simple questions, you're hunting across 5+ tools:
Each question takes 15-30 minutes to answer. Multiply by 10 questions/day across a team.
The Vision: DevSecOps Compass
A centralized platform that gives everyone — developers, DevSecOps, product managers, CTOs — a single view of the entire technology landscape.
Core Principle
One question, one place. Any question about your technology stack — who owns it, what it does, how it's deployed, what's broken — answered in under 10 seconds.
What It Tracks
- • Active/Retired/Development status
- • README completeness
- • Last commit date
- • Branch protection rules
- • Team assignments
- • Primary/Secondary contacts
- • On-call schedules
- • Slack channels
- • Service-to-service connections
- • API consumers
- • Database dependencies
- • Third-party integrations
- • Vulnerability scans
- • Compliance status
- • Secret detection
- • License compliance
- • Cloud resources (AWS/Azure/GCP)
- • Kubernetes deployments
- • Cost allocation
- • Resource utilization
- • API specs (Swagger/OpenAPI)
- • Architecture diagrams
- • Runbooks
- • Change logs
Key Features
1. Service Catalog & Dependency Map
Visual representation of your entire microservices ecosystem. Click any service to see what it depends on, what depends on it, and who owns it.
user-service → notification-service → aws-ses
user-service → payment-service → stripe-api
2. Repository Health Dashboard
Every repository scored on documentation, security, activity, and compliance. Identify abandoned repos, missing READMEs, and security risks at a glance.
3. AI-Powered Issue Resolution
When a security vulnerability is detected, the platform doesn't just alert — it provides context-aware remediation guidance in developer-friendly language.
npm update lodash4. Cloud Cost Attribution
Link AWS/Azure/GCP resources directly to repositories and teams. Answer "how much does this service cost?" instantly.
5. API Catalog with Swagger Integration
Auto-discover and catalog all APIs across your organisation. Link OpenAPI specs, track versions, identify undocumented endpoints.
6. People Directory & On-Call
"Who do I contact about X?" answered in one click. Integrates with PagerDuty, OpsGenie, and Slack for real-time availability.
Who Benefits?
The ROI Case
For a 50-developer team at $150K average cost, 2 hours/week saved = $375K/year in recovered productivity.
How It Works (Technical)
What It Looks Like
Below are conceptual screens showing the platform in action.View interactive prototype →
Why Doesn't This Exist Already?
There are pieces of this solution in the market:
- • Backstage (Spotify) — Service catalog, but requires heavy customization
- • Port, Cortex, OpsLevel — Developer portals, but often lack security depth
- • Snyk, SonarQube — Security scanning, but siloed from ownership data
- • CloudHealth, Kubecost — Cost management, but disconnected from code
The gap is integration. Each tool solves one problem. The value is connecting them into a single, queryable system that anyone in the organisation can use without specialist knowledge.
Interested in Building This?
This is a product vision based on real problems I've seen across dozens of organisations. If you're facing these challenges and want to explore building a solution — whether as a custom internal tool or a commercial product — let's talk.
Start a Conversation