GitHub - better-isms/control-in-code: Open dataset: clean-code changes that move a compliance control (SOC 2, ISO 27001, GDPR...). By heygrc, compliance review for pull requests. · GitHub
/" data-turbo-transient="true" />
Skip to content
Type / to search
Sign in<br>Sign upAppearance settings
You signed in with another tab or window. Reload to refresh your session.<br>You signed out in another tab or window. Reload to refresh your session.<br>You switched accounts on another tab or window. Reload to refresh your session.
Dismiss alert
{{ message }}
Uh oh!
There was an error while loading. Please reload this page.
better-isms
control-in-code
Public
Notifications<br>You must be signed in to change notification settings
Fork
Star
main
BranchesTags
Go to file
CodeOpen more actions menu
Folders and files<br>NameNameLast commit message<br>Last commit date<br>Latest commit
History<br>2 Commits<br>2 Commits
data
data
LICENSE
LICENSE
README.md
README.md
View all files
Repository files navigation
control-in-code
Clean-code changes that move a compliance control. An open dataset of the pull-request patterns that are neither bugs nor vulnerabilities, and still change what a company must answer for under SOC 2, ISO 27001, GDPR, and other frameworks.
This is the knowledge base behind heygrc, compliance review for pull requests. It is published openly because the category is bigger than any product: if you build review tooling, teach secure development, or prepare teams for audits, these patterns are yours to use with attribution (CC BY 4.0).
Why this dataset exists
Code review already answers two questions about a diff: is it correct, and is it safe. There is a third question that rarely has an owner: does this change touch a control the company is audited on. The defining property of that question is that clean, working, secure code can still move a control . A widened IAM role, a trimmed audit log, a new store of personal data with no retention bound: none of these has to be a defect, and each one changes the company's compliance posture.
Every entry here is that shape: a minimal, realistic diff, the framework control it touches (identifier + original plain-English gloss, never normative text), and why. All examples are synthetic and illustrative.
See the live version of these patterns reviewed by heygrc on real pull requests: better-isms/heygrc-demo.
The change patterns (data/patterns.json)
9 common change patterns, each mapped to the controls it commonly implicates across frameworks:
Change pattern<br>Controls it commonly implicates
Log a request body that contains personal data<br>GDPR Art. 5(1)(c); GDPR Art. 32; PCI DSS Req 3
Drop a TLS floor or disable certificate verification<br>SOC 2 CC6.7; NIST 800-53 SC-8; PCI DSS Req 4; HIPAA 164.312(e)(1); ISO 27001:2022 A.8.24
Widen an IAM role or drop an authorization check<br>SOC 2 CC6.1; ISO 27001:2022 A.8.3; NIST 800-53 AC-6; PCI DSS Req 7; HIPAA 164.312(a)(1)
Remove a security-relevant log or alert<br>ISO 27001:2022 A.8.15; SOC 2 CC7.2; NIST 800-53 AU-12; PCI DSS Req 10; HIPAA 164.312(b); EU AI Act Art. 12
Add a personal-data store with no retention or deletion path<br>GDPR Art. 5(1)(e); GDPR Art. 17
Skip a multi-factor check on a sensitive path<br>NIS 2 Art. 21(2)(j); NIST 800-53 IA-2; SOC 2 CC6.1; PCI DSS Req 8
Remove a backup, retry, or failover path<br>DORA Art. 12; DORA Art. 11; ISO 27001:2022 A.8.13
Add a third-party dependency with no integrity check<br>NIS 2 Art. 21(2)(d); PCI DSS Req 6
Remove input validation or disable a security lint<br>ISO 27001:2022 A.8.28; NIST 800-53 SI-10; PCI DSS Req 6; NIS 2 Art. 21(2)(e)
The control deep-dives (data/controls.json)
25 controls, each with the failure shapes it takes in a diff and a worked example:
Framework<br>Control<br>The shapes it takes in a diff
SOC 2<br>CC6.1<br>An access policy widens; An authorization check is dropped; A data grant broadens; A default flips to allow; A privilege-escalation path opens
SOC 2<br>CC6.6<br>A firewall or security group opens to the world; A managed resource is made publicly reachable; An admin or management port is exposed; An allowlist widens; A boundary control is bypassed
SOC 2<br>CC6.7<br>A TLS floor drops; An internal hop goes plaintext; Certificate verification is disabled; A new export sends data out; A protected field becomes loggable
SOC 2<br>CC7.2<br>An alert rule is deleted; A threshold is loosened; A metric stops being emitted; Coverage does not follow new surface; A detection is disabled
SOC 2<br>CC8.1<br>A required approval is removed; A migration skips review; Tests stop gating the merge; A bypass path is added; The rollback is removed
ISO 27001<br>A.8.15<br>A security log is removed; A log level drops below production; The actor is dropped from the record; A new privileged action ships unlogged; Retention is shortened
ISO 27001<br>A.8.24<br>A key lands in code; A weak primitive is introduced; A TLS floor drops; Verification is disabled; Key rotation or scope is loosened
ISO 27001<br>A.8.28<br>A query is built by...