Platform

The architecture is the argument.

Perryscope is built as a product-agnostic platform core — jobs, authentication, encryption, audit, rate limiting, real-time events, and a plugin engine manager — with security products that register against it. That's why it grew from one product to three without re-inventing infrastructure.

Products never import each other. Adding Privacy Security required zero new infrastructure — verified reuse, not aspiration.

Plugin model

Registry patterns everywhere.

The next surface — IDE, desktop, messaging — is an extension point, not a rewrite. Every subsystem that could vary is behind an interface, and most already have multiple implementations shipped.

ScanEngine / EngineManager

Products register detection engines against the platform's engine manager.

Validator registry

GitHub, AWS, Stripe, Azure shipped; new providers plug into the same registry.

ComplianceMapper

One plugin per regulation — GDPR, HIPAA, PCI DSS, DPDP today; CCPA/LGPD/POPIA are mappers away.

GovernanceProvider

Two GRC providers shipped — SimpleRisk and CISO Assistant — behind one interface.

Escalation & remediation registries

Slack, Email, Jira escalators; remediation extension points exist with automation intentionally disabled.

recognizers/enterprise/

A deliberate, empty extension point for organization-specific recognizers. Coming Soon

Security model

Built like the security tool it is.

Encryption

AES-256-GCM / Fernet at rest under your keys; MultiFernet rotation; fail-safe defaults.

Audit

One shared audit table; immutable timelines; reason-required, rate-limited reveal flow.

Access

RBAC — 6 roles, 11 permissions; constant-time API-key comparison; security headers; CORS hardening.

Determinism

Rule-based decision engine; LLMs architecturally confined to optional explanations.

Observability

Deployable, observable, API-first.

✓Prometheus /metrics endpoint
✓Structured JSON logging with correlation IDs
✓Health, liveness, and readiness probes
✓WebSocket event stream with per-scan log replay
✓OpenAPI/Swagger documentation for every endpoint

GET /health → liveness
GET /metrics → Prometheus
POST /scan/github/org → async org scan
GET /scan/status/{id} → poll a job
WS   /ws/jobs → real-time events

Deployment topology

One command to start. A clear path to scale.

Docker Compose with an nginx reverse proxy fronting the React dashboard and FastAPI backend. SQLite works out of the box; switch to PostgreSQL with one environment variable. Scans fan out in parallel workers — 10 shallow / 5 deep concurrent — with semaphores and per-repo timeouts.

docker compose upnginxSQLite → Postgresrepo cache · ~80% faster

Governance sync

Confirmed findings become risk records.

A pluggable sync service creates, updates, closes, and reopens risk records per finding — race-safe row claiming, external-ID persistence before status flip, idempotency that survives crashes and replays. Runs embedded or as a standalone worker container.

SimpleRiskCISO Assistantmake up GOVERNANCE_PROVIDER=…

FastAPI + SQLAlchemyReact 18 + TypeScript + ViteTanStack Query + ZustandRadix UI + TailwindPresidio + spaCyTesseract OCRChrome MV3 (offline)PrometheusDocker ComposeSQLite / PostgreSQL

Judge the architecture yourself.

1,000+ automated tests across the platform. One command to deploy — in your own infrastructure.

Get started Read the docs