Open Data Risk Scanner
Assesses CKAN-like public metadata, resource declarations, descriptions, ownership, reuse signals, and risk scoring.
Mature MVPdati.gov.it
Public-sector digital governance · Cybersecurity · Reproducible risk assessment
OpenGovSec Toolkit
OpenGovSec Toolkit is a modular cybersecurity and digital-governance project for passive, reproducible analysis of public-sector open-data metadata, API documentation, and repository readiness.
It is designed as a portfolio-grade case study: public data sources, transparent checks, documented risk scoring, Markdown reports for human review, JSON outputs for automation, and CSV summaries for dashboards or CI artifacts.
Current MVP scope
The project now demonstrates three passive modules: open-data risk scanning, API security-documentation checking, and repository supply-chain-readiness checking.
API Security Documentation Checker
Reviews OpenAPI-like documents for security schemes, security requirements, operation IDs, error responses, contact metadata, and license metadata.
Good/weak demoPDND direction
Repository Supply-Chain Readiness
Reviews repository metadata for license, README, dependency manifests, lockfiles, CI, security policy, dependency updates, releases, SBOM, and activity.
Good/weak demoSupply-chain direction
Demo results from dati.gov.it
Three public CKAN metadata queries were evaluated. Each query produced source JSON, a Markdown report, a machine-readable JSON report, and an aggregate CSV summary.
60
public dataset records assessed across three demo queries.
60
records classified as low risk in the current triage model.
3
output formats demonstrated: Markdown, JSON, and CSV summary.
| Query | Datasets | Risk result | Main findings | Outputs |
|---|---|---|---|---|
| ambiente | 20 | All low risk | catalogue-record-resource, service-only-resource, weak-description | Markdown · JSON |
| sanita | 20 | All low risk | weak-description | Markdown · JSON |
| trasporti | 20 | All low risk | service-only-resource | Markdown · JSON |
Aggregate CSV: reports/dati_gov_it_demo_summary.csv
API and repository good/weak demos
The API and repository modules include paired good/weak examples to demonstrate the risk model and reporting output without live service testing.
| Module | Input | Report | Result |
|---|---|---|---|
| API documentation | security-complete OpenAPI | good report | low risk, no findings |
| API documentation | weak OpenAPI | weak report | high risk, documentation findings |
| Repository readiness | supply-chain-ready metadata | good report | low risk, no findings |
| Repository readiness | weak metadata | weak report | critical risk, readiness findings |
Reproducible workflow
The core value of OpenGovSec is not only the scanners, but the traceable chain from documented inputs to human-readable and machine-readable outputs.
public catalogue metadata → local JSON source → passive scanner → Markdown report → JSON report → CSV summary
OpenAPI / repository metadata → passive checker → good/weak Markdown reports
OpenAPI / repository metadata → passive checker → good/weak Markdown reports
Direction
OpenGovSec is being developed as a single modular toolkit rather than a collection of unrelated scripts.
Near-term development
Specialize the API checker toward PDND/API documentation readiness and extend repository readiness into a broader public-administration supply-chain radar.
Portfolio role
The project demonstrates applied cybersecurity, public-sector digital governance, risk-model design, reproducible reporting, and technical communication.