Soteria
The keeper of safety and preservation — embedding security practices, threat modeling, and compliance controls into the flow of every team rather than treating security as a gate.
Security leadership
Soteria is led by the platform's founder, who is accountable for the security of everything osinfra.io publishes and operates.
Brett Curtis
Founder & Security Lead, osinfra.io
Taking a 🔨 to the foundations of Infrastructure as Code. Accountable for platform security architecture, vulnerability response, and security testing across every osinfra-io repository.
What Soteria owns
Secure by default
CIS-aligned GCP projects, workload identity federation instead of long-lived keys, encrypted state, and OPA Gatekeeper policy enforcement on every cluster.
Supply-chain integrity
Every module source and GitHub Action is pinned to a full commit SHA, with Dependabot and pre-commit security hooks keeping dependencies current.
Zero-trust networking
Istio ambient service mesh, mutual TLS, gateway authentication with Authentik, and secrets management with OpenBao.
Security testing
End-to-end testing of the platform and the third-party components it integrates, performed only against systems osinfra-io owns and operates.
Defensive and offensive functions
Soteria combines defensive engineering with offensive testing so that controls are validated by attempting to break them. All activity targets only systems osinfra-io owns and operates.
Blue team — defense
Designs and maintains preventive and detective controls: IAM and least privilege, policy enforcement, secrets management, hardened pipelines, monitoring and alerting, and incident response.
Red team — offense
Emulates realistic adversaries against our own deployments: attack-path analysis, privilege escalation and lateral-movement testing, and attempts to bypass mesh, gateway, and policy controls.
Vulnerability research
Reviews code, OpenTofu, Kubernetes, and CI/CD configuration for misconfigurations and weaknesses, then triages findings by severity and exploitability.
Purple teaming
Feeds every offensive finding back into detections, guardrails, and documentation, so each test leaves the platform measurably harder to attack.
Offensive work follows defined rules of engagement: it runs only against our own GitHub organization and GCP environments, never against third-party or shared systems, and every finding is fixed and disclosed through the process below.
Vulnerability disclosure
Every repository publishes its own security policy in a SECURITY.md file (for example, the policy for this documentation site). Report vulnerabilities privately from the affected repository's Security tab by selecting Report a vulnerability; Soteria triages, fixes, and publishes the outcome. If private reporting isn't available for a repository, open a public issue there that asks for a private channel and contains no vulnerability details.
Scope
osinfra.io is an open-source reference implementation, so its code, configuration, and architecture are public by design. Security testing covers only the systems the osinfra-io organization owns and operates: its GitHub organization and its own GCP environments. Third-party platforms are tested only within our own deployments of them.