The demo uses logically separated validator evidence inside the same GitHub Actions environment. The completed demonstration is synthetic and intentionally harmless.
Public source · completed run · synthetic data
Cyber-exposure management reference implementation by Alfe CoronaSecurity architecture · engineering · automation
Make closure
evidence-gated.
Exposure Control connects normalized security findings to explainable priority, recorded ownership, tracked remediation work, and newer validation evidence before closure.
Evidence: view the completed synthetic lifecycle ↗THE CONTROL PATH
One visible chain from signal to closure.
Accepted findings move through accountable work states. Validation is a gate—not a decorative final step—and closure remains conditional on newer evidence.
Detect and Prioritize form the input and policy boundary. Ticket is remediation work. Validate and Close form the validation gate.
- Control group: Input and policy boundary.Normalized signal
Detect
Scheduled and on-demand repository scans, plus JSON and JSONL file input.
- Control group: Input and policy boundary.Explainable P0–P4
Prioritize
A deterministic, versioned policy combines technical and business context.
- Control group: Remediation work.Tracked work
Ticket
GitHub Issues record stable identity, priority, an owner identifier, and evidence.
- Control group: Validation gate.Newer evidence
Validate
The gate checks tenant and exposure identity, logical source separation, evidence freshness, and a resolved outcome.
- Control group: Validation gate.Conditional state
Close
Closure proceeds only after qualifying newer evidence passes the gate; otherwise work stays open.
A real deployment requires separately permissioned identities, authoritative scanner retests, operating controls, and measured reliability.
WHAT I BUILT
Architecture carried through to working controls.
I designed the lifecycle and implemented the vertical slice: schemas, scoring, adapters, persistence, GitHub ticket automation, validation gates, tests, and deployment references.
01 / MODELCanonical schemas and workflow invariants
02 / DECIDEVersioned, deterministic P0–P4 risk policy
03 / ACTIdempotent GitHub Issues workflow adapter
04 / STORESQLite persistence and a PostgreSQL adapter with forced tenant row-level-security policies
05 / ASSURETests, scanners, workflow permissions, and deployment references
Runnable portfolio MVP
File ingestion, risk scoring, GitHub ticket workflow, two persistence adapters, repository scanners, a dashboard, and a safe lifecycle demo.
Authoritative sources and operations
IAM, EDR, CSPM, CMDB, Jira, and ServiceNow integrations are extension points—not implemented capabilities. Production also needs recovery, security, reliability, and scale controls.
CONTROL VALUEReview production boundaries
An inspectable path from finding to closure.
The reference flow makes priority, owner identifiers, evidence age/source, workflow history, and closure rationale inspectable.
IMPLEMENTATION EVIDENCE
Material claims with direct review paths.
This is repository evidence for a working reference implementation—not live customer telemetry, a production-health dashboard, or a customer outcome claim.
Completed synthetic lifecycle
The completed maintainer-run synthetic demonstration links its finding-to-closure workflow record for review. GitHub limits manual workflow dispatch to people with repository write access.
Inspectable implementation
Schemas, scoring policy, adapters, persistence, workflow logic, tests, threat model, and deployment references.
Dated public-main CI
CI for public main commit 4db8b02 succeeded on August 19, 2026. This is dated evidence, not live telemetry.
Limits stated up front
Synthetic data and one automation environment demonstrate the design; authoritative integrations and operations remain production work.
Repository operations dashboard
Maintainers can run the workflow on demand. Mutable issue state remains at the authoritative repository source.
PROJECT FIT
Evidence for the role, not a product pitch.
Exposure Control demonstrates Alfe Corona’s approach to cybersecurity architecture, secure automation, cloud security engineering, and clear communication across security, engineering, and risk stakeholders.