Bastion

Self-hosted access control — auth, MFA, sessions, and audit logs, with zero third-party access to your data.

Dashboard

Overview of your identity infrastructure

Total Users

2,847

+12

Active Sessions

143

-8

Policies Enforced

24

+2

Events (24h)

8,392

+18%

Auth Methods

Details
2,847
total
Password
1,28145%
SSO / OAuth
79728%
MFA (TOTP)
51218%
API Keys
2579%

Access Decisions (24h)

Details
Allowed
Denied

WhatBastiondoes.

Identity & Access

JWT tokens with secure cookies. Google & GitHub OAuth, org-wide IdP enforcement.

Access Rules

Dynamic RBAC across users, roles & policies. Explicit DENY always wins.

Stay Verified

TOTP + backup codes, step-up reauth on sensitive actions.

Every Action, Logged

Filterable, exportable audit logs with real-time alerts. Fully self-hosted.

Policy Simulator

Test policy changes against real scenarios before they ship.

Effective Permissions

Per-user view of every permission — direct, inherited, and policy-attached.

Scoped API Keys

Keys scoped to exact actions, with reauth and instant revocation.

Securebydefault.

Hardened Builds

Read-only app code, pinned dependencies. No surprise CVEs from upstream.

Runtime Isolation

Non-root containers, dropped capabilities. Falco watches syscalls live.

Continuous Scanning

SonarCloud, CodeQL & Trivy gate every PR and image before ship.

Encrypted Secrets

Credentials stay encrypted in Git via SealedSecrets, always.

Request Guardrails

Rate limiting and input validation stop malformed or abusive requests early.

Network Defense

CrowdSec blocks malicious IPs; Falco alerts stream to Datadog.

Howeverychangeships.

Continuous Integration

Linting, tests, scans, and builds gate every commit — producing a signed, hardened image only when everything passes.

Learn more →
Security architecture diagram

Continuous Deployment / GitOps

Merging main updates Kustomize overlays via bot PR. ArgoCD reconciles the cluster automatically — no manual apply.

Learn more →
GitOps deployment diagram

Boot Sequence

Init containers enforce startup order: DB check, migrations, then services — ensuring zero boots on unready databases.

Learn more →
Boot sequence order diagram

Theriskengine.

Model Retraining

A daily CronJob retrains on recent activity and hot-swaps the model — no restart needed.

Learn more →
Model Retraining diagram

Risk Evaluation

Every request is scored on login history, action, and timing. High risk triggers step-up auth.

Learn more →
Risk Evaluation diagram

Resilient Fallback

If scoring fails, auth doesn't stop — it defaults to a neutral score and keeps running.

Learn more →
Resilient Fallback diagram

Zerotrust,bydesign.

One Policy, Everywhere

The same deny-first rule governing user access governs service-to-service traffic too.

One Policy, Everywhere

Least Privilege

Workloads get scoped to exactly what their job requires — nothing assumed.

Least Privilege

Trust Never Expires

Sessions are re-verified continuously, across every device.

Trust Never Expires

TryBastionnow.

The project's open and ready for contributors — dig into the code or open an issue anytime.

View on GitHub