# HummerRisk/HummerRisk

HummerRisk 是云原生安全平台，包括混合云安全治理和云原生安全检测。

Repository: https://github.com/HummerRisk/HummerRisk
Canonical: https://ross.abutalabs.com/products/hummerrisk
Homepage: https://hummerrisk.com
Language: Java
License: GPL-3.0
License Family: copyleft
Topics: cloud-custodian, cloud-native, prowler, security, sbom, cloud-native-security, cspm, k8s-security, kubernetes-security, trivy, compliance, compliance-as-code, vulnerability
Last push: 2024-12-26T06:59:59+00:00

## Health v2 (maintenance only)
Score: 23/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 0, release rhythm 8, longevity 100
- inputs: {"age_days": 1552, "days_push": 615, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1512, forks 238 (observed 2026-08-28T04:04:56.110404+00:00)

## What it is
HummerRisk is an open-source, agentless cloud-native security platform for hybrid cloud security governance and Kubernetes/container security detection. It provides compliance checks (CIS, MLPS 2.0), cloud resource posture management, image/source/SBOM scanning, and audit reporting across major public and private clouds.

## Use cases
- run CIS compliance checks on AWS, Azure, and Alibaba Cloud accounts
- detect misconfigurations and vulnerabilities in Kubernetes clusters
- manage and analyze SBOMs for software supply chain risk
- audit cloud account activity logs across multiple clouds
- scan container images and source code for dependency vulnerabilities
- generate cloud security compliance reports
- get a unified posture view of hybrid cloud resources

## When to choose
- you need a self-hosted, agentless CSPM covering many Chinese and international clouds
- you want combined cloud compliance and K8s/container security in one platform
- you need SBOM management and supply chain risk detection

## When to avoid
- you only need a lightweight single-purpose scanner like Trivy or Prowler
- you require a SaaS-managed security product
- you need non-Linux deployment or Windows-native tooling

## Facets
- artifact type: application
- maturity: maintenance
- function: security, vulnerability-scanning, monitoring
- domain: security, cloud-computing, self-hosted
- platform: self-hosted
- tags: cspm, cloud-security, kubernetes-security, sbom, hybrid-cloud, compliance, agentless, multi-cloud, java, compliance-as-code, containers, devops, linux, docker, web-server

## Member repositories
- HummerRisk/HummerRisk (main) score 23

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:04:56.110404+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T04:32:18.520192+00:00, confidence not recorded.
  - readme: https://github.com/HummerRisk/HummerRisk (fetched 2026-08-28T04:04:56.110404+00:00, sha 63d469cd510a)
- Data as of 2026-08-30T08:39:29.467469+00:00.