Gouvernance
Audit-as-a-service · protected accessAn "audit-as-a-service" platform — currently used for the Liora Cyber Admin project (DATASC.SEA IS-governance audit). It merges two normally-separate deliverables: an IS-governance consulting dossier (audit, AMDEC risk analysis, 4 costed target architectures) and a "command center" web app that makes it browsable, faithful and secure. Static Astro site on Cloudflare, ⌘K Pagefind search, Mermaid diagrams, server-side PIN lock. Zero external runtime dependency.
Why I built it
The Liora Cyber Admin project required a full IS-governance audit: risk analysis, target architecture, continuity plan. A classic consulting dossier stays a PDF nobody opens. I turned it into a product: gouvernance.mindvisionstudio.com is an "audit-as-a-service" platform that takes the DATASC.SEA dossier — 76,000 words of analysis, 64 scored AMDEC risks, 4 costed target architectures — and makes it browsable, interactive and secure, on desktop and mobile. Static Astro site served from the Cloudflare edge, ⌘K full-text search indexed at build, on-demand Mermaid diagrams, and a server-side PIN lock that guarantees the dossier's confidentiality. The template is reusable: one audit, one dedicated space.
Structural technical decisions
The project merges two normally-separate deliverables: the IS-governance consulting dossier (audit, AMDEC, target architecture) and a "command center" web app that brings it to life. The value remains the analysis work (~55%); the software layer (~45%) turns it into an interactive steering tool, reusable for the defense as for a real client.
A single selector switches the entire site (mapping, sizing, budget) onto one of 4 target approaches, each hardened "against the jury" with CAPEX, OPEX and 5-year TCO (from €372k to €813k). The audit and risks are common to all 4; only the architecture varies — the sovereign hybrid is retained (~€405k, 15% below the reference).
No content page is served without a valid cookie (Cloudflare Worker). HMAC-SHA256 signed cookie via Web Crypto (HttpOnly, 30-day expiry, auto-login), constant-time PIN comparison (timingSafeEqual, no timing leak), anti-brute-force 10 fails / 15 min per IP in KV, secrets out of code. Self-hosted fonts, search and data computed at build: nothing to fetch in production.
The Markdown content (29 briefs + report) runs through 6 custom remark/rehype plugins: Obsidian wikilinks → internal links, callouts → teaching notes driven by the Study/Clean toggle, coloring of risk IDs / IPs / scores, tables → cards on mobile. The AMDEC dashboard is parsed at build from a TSV — no application database.
The non-trivial challenge
A governance-audit dossier contains network plans, IPs, exploitable vulnerabilities: it must never leak. The challenge: lock down a fully static site with no application backend. Answer: a Cloudflare Worker intercepts every request and refuses any content page without a valid cookie. The PIN is compared in constant time, the cookie is HMAC-SHA256 signed (Web Crypto), and a KV counter blocks the IP after 10 fails in 15 min. Everything else is resolved at build (Pagefind search, AMDEC dashboard, self-hosted fonts) — zero third-party service called at runtime, minimal attack surface.
Lesson learned
A consulting deliverable gains ten times the value when it becomes a browsable, secured product. Static + edge doesn't forbid confidentiality: a well-built server lock (HMAC cookie, timing-safe PIN, KV anti-brute-force) protects a 100% pre-rendered site without sacrificing speed or cost. And the "audit-as-a-site" template is reusable — a dedicated space per engagement, the content changes, the engineering stays.
Features
Sort / filter / search by severity & domain across the 64 AMDEC rows (55 scored vulnerabilities, Risk /10 = Impact /5 + Probability /5)
Switches the whole site (architecture, sizing, budget) onto one of 4 costed targets (retained hybrid, full on-prem, full cloud, budget Proxmox) — CAPEX / OPEX / 5-year TCO
Numbered knowledge base loaded from the Markdown source, Study / Clean toggle that hides or reveals the teaching notes
100% static full-text search indexed at build (Pagefind), no search backend, grouped side-nav + mobile drawer
No content page is served without a valid cookie — HMAC-SHA256 signed cookie (HttpOnly, 30-day expiry), constant-time comparison, anti-brute-force 10 fails / 15 min per IP in KV
Web report faithful to the PDF source + viewer for the 5 PDF deliverables (~5.6 MB), CSV / TSV exports of the risk table
Target architecture + Gantt rendered client-side on demand (lazy), only on the mapping pages
CIA counters, top-10 risks and per-domain distribution computed at build from the AMDEC TSV — no application database