Evidence that your code changes were checked

What you receive

One stored report per framework and project selection. It counts a project when the project has a trusted scan from the last 90 days, uploaded from CI or run by Skylos Cloud, that covered the whole repository with the security, secret and dependency checks.

The report

JSON, CSV, HTML, PDF, SARIF, all from the same stored report. The full edition stays inside your team: it has file paths and finding text. The external edition (HTML, PDF or CSV) is for an auditor or customer and shows counts in place of findings.

Every requirement, with a status

Each requirement of the framework edition is listed, including the ones a code scan cannot evidence. Findings carry the date they were found and a fix-by date. Accepted risks are listed with who approved them and when they end.

A public verification link

Each report prints a link to skylos.dev/verify/report/<id>. The page says whether Skylos signed the report and whether the record Skylos stores is unchanged. It checks that stored record, not the PDF or CSV in your auditor's hand; the JSON download is the signed original to compare a copy against. It never shows your organization, repositories or findings.

SOC 2 pre-assessment

A SOC 2 report adds a section with a system description, 6 control tests with the population and the result, deviations, and a table per criterion of what the tests show. Skylos pre-assessment, shaped like sections III to V of a SOC 2 Type 2 report. Skylos tested its own records; this is not an auditor's test, opinion or report.

Evidence files per control

The SOC 2 control tests come with the records they were run on, as 11 CSV files your auditor can sample from: merged_prs.csv, scan_checks.csv, weekly_scans.csv, scan_gaps.csv, findings.csv, cicd_findings.csv, secret_findings.csv, branch_settings.csv, dependency_coverage.csv, deviations.csv, readiness.csv. When the auditor picks pull requests, findings or exceptions to test, you get one evidence packet for exactly those items from the stored report, at no extra charge.

Draft questionnaire answers

From a SOC 2 report, draft answers to common customer questions about code scanning, fixing vulnerabilities and change review, each with the numbers from that report and a note on what you must add yourself. You check each one before you send it. On Vanta, Drata or Secureframe? See which file to upload where.

Change history, audit log and access review

On the Workspace, Growth and Enterprise plans: an export of every pull-request scan in a date range with the check result and who overrode a failed check and why, the workspace audit log, and a page that lists who can see and change the workspace.