# Trusted OSS — full guide index

English pages live under /en (for example, /en/docs). Korean pages live at the
same path without the prefix (/docs).

## Building the management system (/docs)

- 00. Overview and software supply chain security
- 01. Environment setup
- 02. Organizational structure (the open source program office)
- 03. Policy (the open source policy document)
- 04. Process design
- 05. Tools (SBOM generation, management, vulnerability analysis)
- 06. Training
- 07. Self-certification (declaring ISO/IEC 5230 and 18974 conformance)
- 08. Developer guide

## AI coding (/ai-coding)

- Introduction: how AI coding tools break open source policy
- The five-level strategy: prompt-dependent, rules embedded, CI/CD blocking, AI review, automatic remediation
- Common rules template: license, security, SBOM, and copyright rules
- Claude Code (CLAUDE.md) configuration
- Cursor (.cursor/rules/) configuration
- GitHub Copilot (copilot-instructions.md) configuration
- Devin Desktop (.devin/rules/) configuration
- Cline / Aider (.clinerules / AGENTS.md) configuration
- Quick CI/CD: syft, grype, and license blocking in 30 minutes

## DevSecOps (/devsecops)

- Adoption strategy: maturity model and phased roadmap
- SAST: Semgrep and CodeQL static analysis
- SCA: syft and grype for SBOM and vulnerability management
- Secret detection: Gitleaks and truffleHog
- Container security: Trivy image scanning
- IaC security: Checkov and tfsec
- DAST: OWASP ZAP and Nuclei dynamic analysis
- Pipeline design: the full GitHub Actions and GitLab CI integration
- Monitoring and automatic remediation: Dependabot and Renovate
- ISO/IEC 18974 alignment: requirement mapping and evidence automation

## Agents (repository)

Running the agents needs a clone of the repository. Korean agents live under
agents/, English agents under agents/en/. Both write to output/ and read their
templates from templates/ and templates/en/ respectively.

- 02 to 07: the self-study chain, from organization design to the self-certification declaration
- ai-coding-setup, devsecops-setup: generate configuration for an existing project
- sbom-vuln-analyst, sast-analyst, secret-analyst, iac-fixer: turn scan results into reports and fixes