Skip to content
SPECIFICTION
Get listed

Aperio

github.com

WebLinuxAPISelf-hosted
Visit github.com
Spec score 7.7 #10 of 30 in SaaS Security Posture Management Software

What it is

Aperio is an open-source SaaS Detection & Response platform for identifying SaaS posture risks, cataloging OAuth shadow IT, and sending findings to security systems. It connects to GitHub, Slack, Google Workspace, Okta, 1Password, Microsoft 365, and Atlassian Jira and Confluence. Listed detections include public GitHub repositories, Slack workspace 2FA enforcement, and multiple Google Workspace sharing, administration, Gmail, delegation, and OAuth risks. Okta, 1Password, Microsoft 365, and Atlassian are connection-only while their rule packs remain pending. Findings retain evidence, receive severity scores, support deduplication and risk exceptions, and can resolve automatically when a later sync no longer detects the signal. SIEM destinations include Splunk HEC, Panther, Panopticon, Elasticsearch, Datadog Logs, webhooks, and JSON Lines files, delivered through a retrying durable outbox. Working remediation handlers cover suspending Okta users, resetting Okta MFA, and revoking Slack OAuth apps. Human approval is required before provider-side writes, with two-person approval for response actions. Aperio is MIT licensed and supports self-hosted Compose deployment with PostgreSQL 15 or later.

Spec sheet

Purpose
Aperio is an open-source SaaS Detection & Response platform for detecting SaaS posture risks, inventorying OAuth shadow IT, and streaming findings to security systems.Read 9 Oct 2026 · github.com
Deployment
Aperio can be run with a self-hosted Compose deployment and requires PostgreSQL 15 or later for the documented local setup.Read 9 Oct 2026 · github.com
Security
Connector credentials are encrypted at rest with AES-256-GCM; the stack also lists cookie sessions, TOTP MFA, and role-based access control.Read 9 Oct 2026 · github.com
License
The repository identifies Aperio as MIT licensed.Read 9 Oct 2026 · github.com
Headquarters
San Francisco, California, United StatesRead 28 Sep 2026 · github.com
Founded
2020Read 28 Sep 2026 · github.com
Maker
The GitHub repository is published under the writer organization.Read 9 Oct 2026 · github.com
Approval controls
Agent proposals require human approval before provider-side writes, and response actions use two-person approval.Read 9 Oct 2026 · github.com
Connector limits
Okta, 1Password, Microsoft 365, and Atlassian are listed as connection-only, with their rule packs pending.Read 9 Oct 2026 · github.com
Detection coverage
The repository lists detections for public GitHub repositories, Slack workspace 2FA enforcement, and several Google Workspace sharing, admin, Gmail, delegation, and OAuth risks.Read 9 Oct 2026 · github.com
Findings
Findings support evidence persistence, severity scoring, deduplication, risk exceptions, and automatic resolution when a signal disappears on a later sync.Read 9 Oct 2026 · github.com
Human approval
Agent proposals require human approval before provider-side writes, and response actions are described as human-gated with separation of duties.Read 9 Oct 2026 · github.com
Incident handling
It opens and deduplicates incidents with evidence and a replayable timeline, and can auto-resolve findings after a later sync no longer detects the signal.Read 9 Oct 2026 · github.com
OAuth inventory
A per-user Google Workspace token scan catalogs third-party OAuth apps and assigns CRITICAL, HIGH, MEDIUM, or LOW risk levels based on scope sensitivity.Read 9 Oct 2026 · github.com
Remediation
The repository lists working remediation handlers for suspending Okta users, resetting Okta MFA, and revoking Slack OAuth apps; other handlers are described as stubbed and pluggable.Read 9 Oct 2026 · github.com
SaaS connectors
Built-in connectors cover GitHub, Slack, Google Workspace, Okta, 1Password, Microsoft 365, and Atlassian Jira and Confluence.Read 9 Oct 2026 · github.com
Security controls
The repository describes AES-256-GCM encryption for credentials, cookie sessions, TOTP MFA, role-based access control, and organization-scoped tenant isolation.Read 9 Oct 2026 · github.com
SIEM delivery
SIEM deliveries use a durable outbox with retries and deduplication by finding and destination.Read 9 Oct 2026 · github.com
SIEM integrations
SIEM destinations include Splunk HEC, Panther, Panopticon, Elasticsearch, Datadog Logs, generic webhooks, and JSON Lines files.Read 9 Oct 2026 · github.com
Tenant isolation
The repository describes Aperio as multi-tenant, with organization scoping and tenant isolation enforced at route, repository, and integration layers.Read 9 Oct 2026 · github.com

Strong points and limits

Strong points

  • Open-source MIT license
  • Connectors for major SaaS systems
  • Evidence-backed, deduplicated findings
  • Multiple SIEM delivery destinations
  • Human-gated remediation actions

Limits

  • Several connectors have rule packs pending
  • Self-hosted setup requires PostgreSQL 15 or later
  • Some remediation handlers are stubbed
  • Provider writes require human approval

Who it suits

Aperio suits security teams managing SaaS risk, OAuth inventory, incident workflows, and integrations with SIEM systems. It also fits organizations needing self-hosted, multi-tenant deployment with approval controls.

Verdict

Aperio combines SaaS detection, OAuth inventory, incident handling, SIEM delivery, and selected remediation. Its pending rule packs and partially stubbed handlers matter when planning coverage.

Where Specifiction places it

Alternatives to AperioAll alternatives →