WombatFormerly known as WAF++
The future of cloud architecture starts today.
Wombat is an open, cloud-agnostic framework that makes your infrastructure sovereign, secure, and audit-ready — mapped to 100+ controls across 8 pillars.
The time is now!
For years, cloud architecture reviews meant lock-in to one vendor, fake compliance checklists, or consultants with slide decks. Wombat starts from a clean slate: a vendor-neutral framework, a static CLI that reads your code, and proof anyone can verify.
Find out how we can help you growThree ways Wombat changes how you review cloud architecture.
Sovereign cloud assessment
Run the same scan against AWS, Azure, GCP, and European providers like OVH, Hetzner and STACKIT. Sovereign is a first-class pillar, not an afterthought.
Learn moreSecurity before deployment
Hardcoded secrets, open network paths and missing access controls are flagged before commit. Static analysis means no credentials and no cloud API calls.
Learn moreAudit-ready evidence
Lock every scan into an immutable, hash-verified evidence package with a QR code auditors can check themselves. No screenshots, no slide decks.
Learn moreWhy teams choose Wombat.
Built for tech leads, architects, platform teams, security, compliance, and consultants who need a shared, repeatable lens.
Value first
Apache 2.0 and cloud-agnostic by design. No vendor lock-in, no license tiers, no surprise bills.
High performance
Static scans finish in seconds. No waiting on cloud APIs, no throttling, no runtime agents to deploy.
Smart automations
Plug into CI, pre-commit, or the v1.1 agentic pillar for policy-aware reviews that run on every pull request.
Advanced security
100+ controls across 8 pillars catch misconfiguration, exposed secrets, and compliance gaps before they reach production.
Outcomes for the whole cloud team.
Built for tech leads setting a baseline, architects designing with a shared vendor-neutral lens, platform teams wiring controls into pipelines, security and compliance proving governance with evidence, and consultants running repeatable assessments for clients.
Sovereign by design
Run WOMBATpass against workloads on AWS, Azure or GCP, or European providers like OVH, Hetzner and STACKIT. The sovereign pillar treats all of them as first-class.
Secure before deployment
Hardcoded passwords, API keys and tokens get flagged before they're committed for good, not after they're already sitting in your git history.
Audit-ready, always
Lock a scan into an immutable, hash-verified evidence package with a QR code auditors can check themselves. No screenshots, no slide decks.
Cost transparency
Cost sits next to security and reliability as its own pillar, scored the same way, so waste shows up in the same report as risk, not a separate tool.
Eight pillars. One coherent system.
Six proven Well-Architected pillars, plus the two that matter most for sovereign, AI-assisted cloud operations.
From code to proof.
Write Terraform
Build infrastructure-as-code the way you already do. Wombat stays out of your workflow until you run it.
Run WOMBATpass
A static scan reads every resource against the framework's 100+ controls with wombat check . --output json. No credentials, no API calls into your cloud account.
Ship with proof
Export the run as an auditor-ready PDF, or lock it into an evidence package anyone can verify independently.
Built by four people, in the open.
Wombat is maintained by a small team and shaped through an open RFC process. Anyone can propose a change.
Author of Implementing GitOps with Kubernetes, co-founder of connectii.io.
TÜV-certified IT security advisor, across AWS, Azure, GCP and European clouds.
Watches development from a management lens, focused on staying vendor-independent.
Builds the tooling that lets developers and internal customers move faster.
Built by the community
Maintainer
Recent GitHub contributors
2 code contributors
Your first scan takes two minutes.
Install the CLI, point it at your Terraform, and read real findings. No signup, no sales call.
git clone https://github.com/WAF2p/wafpass-core.git
For the full stack (CLI + Server + Dashboard) see the complete installation guide.
