Aperio
San Francisco, California, United States
What it is
Aperio is an open-source SaaS Detection & Response platform for finding SaaS posture risks, cataloging OAuth shadow IT, and sending findings to security systems. Connectors cover GitHub, Slack, Google Workspace, Okta, 1Password, Microsoft 365, and Atlassian Jira and Confluence. Detection coverage includes public GitHub repositories, Slack workspace two-factor enforcement, and multiple Google Workspace sharing, administration, Gmail, delegation, and OAuth risks. Findings retain evidence, receive severity scores, support deduplication and risk exceptions, and can resolve automatically when a later sync no longer sees the signal. Google Workspace token scans inventory third-party OAuth apps and assign CRITICAL, HIGH, MEDIUM, or LOW levels. SIEM destinations include Splunk HEC, Panther, Panopticon, Elasticsearch, Datadog Logs, webhooks, and JSON Lines. Aperio is MIT licensed, self-hostable with Compose, and documents PostgreSQL 15 or later.
For and against
For
- Open-source MIT license
- Broad SaaS connector coverage
- Evidence and replayable incident timelines
- Multiple SIEM delivery destinations
- Human approval gates provider writes
Against
- Several connectors have rule packs pending
- Local setup requires PostgreSQL 15 or later
- Some remediation handlers remain stubbed
- Self-hosted deployment requires operational work
The verdict
Aperio offers broad detection, evidence handling, and security-system delivery with explicit approval controls. Review connector readiness and the self-hosting requirements for your environment.
Who it suits
Aperio fits security teams that need open-source SaaS monitoring, OAuth inventory, SIEM delivery, and controlled remediation. It suits organizations able to operate a self-hosted or API-based deployment.
On the record
- Approval controls
- Agent proposals require human approval before provider-side writes, and response actions use two-person approval.github.com · read 9 Oct 2026
- Connector limits
- Okta, 1Password, Microsoft 365, and Atlassian are listed as connection-only, with their rule packs pending.github.com · read 9 Oct 2026
- Deployment
- Aperio can be run with a self-hosted Compose deployment and requires PostgreSQL 15 or later for the documented local setup.github.com · read 9 Oct 2026
- Detection coverage
- The repository lists detections for public GitHub repositories, Slack workspace 2FA enforcement, and several Google Workspace sharing, admin, Gmail, delegation, and OAuth risks.github.com · read 9 Oct 2026
- Findings
- Findings support evidence persistence, severity scoring, deduplication, risk exceptions, and automatic resolution when a signal disappears on a later sync.github.com · read 9 Oct 2026
- Human approval
- Agent proposals require human approval before provider-side writes, and response actions are described as human-gated with separation of duties.github.com · read 9 Oct 2026
- Incident handling
- It opens and deduplicates incidents with evidence and a replayable timeline, and can auto-resolve findings after a later sync no longer detects the signal.github.com · read 9 Oct 2026
- License
- The repository identifies Aperio as MIT licensed.github.com · read 9 Oct 2026
- Maker
- The GitHub repository is published under the writer organization.github.com · read 9 Oct 2026
- OAuth inventory
- A per-user Google Workspace token scan catalogs third-party OAuth apps and assigns CRITICAL, HIGH, MEDIUM, or LOW risk levels based on scope sensitivity.github.com · read 9 Oct 2026
- Purpose
- Aperio is an open-source SaaS Detection & Response platform for detecting SaaS posture risks, inventorying OAuth shadow IT, and streaming findings to security systems.github.com · read 9 Oct 2026
- Remediation
- The repository lists working remediation handlers for suspending Okta users, resetting Okta MFA, and revoking Slack OAuth apps; other handlers are described as stubbed and pluggable.github.com · read 9 Oct 2026
- SaaS connectors
- Built-in connectors cover GitHub, Slack, Google Workspace, Okta, 1Password, Microsoft 365, and Atlassian Jira and Confluence.github.com · read 9 Oct 2026
- Security
- Connector credentials are encrypted at rest with AES-256-GCM; the stack also lists cookie sessions, TOTP MFA, and role-based access control.github.com · read 9 Oct 2026
- Security controls
- The repository describes AES-256-GCM encryption for credentials, cookie sessions, TOTP MFA, role-based access control, and organization-scoped tenant isolation.github.com · read 9 Oct 2026
- SIEM delivery
- SIEM deliveries use a durable outbox with retries and deduplication by finding and destination.github.com · read 9 Oct 2026
- SIEM integrations
- SIEM destinations include Splunk HEC, Panther, Panopticon, Elasticsearch, Datadog Logs, generic webhooks, and JSON Lines files.github.com · read 9 Oct 2026
- Tenant isolation
- The repository describes Aperio as multi-tenant, with organization scoping and tenant isolation enforced at route, repository, and integration layers.github.com · read 9 Oct 2026
