Self-hosted cross-source ghost-access auditor
Credentials that outlive their owners.
Afterlife joins your cloud IAM keys, code-host access, and IdP lifecycle state into one identity graph, then fires the moment a credential is still live but the person behind it is gone. Self-hosted, so it never holds your keys.
9 sources joined · self-hosted · nothing phones home · MIT
$ afterlife analyze CRITICAL OFFBOARDED-OWNER aws iam key AKIA...QF7 owner bob suspended in Okta 41d ago CRITICAL ADMIN-CONCENTRATION person dave admin in Google Workspace + AWS + GitHub CRITICAL PUBLIC-ROLE-TRUST aws role/ci-deploy Principal "*", no restricting condition HIGH ORPHANED-GITHUB github pat ghp_...9c owner left the org, token still live HIGH STALE-OAUTH google oauth: Zapier write scope, unused 213d MEDIUM UNROTATED-KEY gcp sa key age 402d, past 180d threshold 20 findings, 16 persons across 8 sources (6 cross-source), ranked by blast radius.
Real output format. Reproduce every finding locally with make demo.
Your CSPM and your IdP each answer half the question
Offboarding propagates inconsistently. An IdP marks a contractor suspended, but the long-lived AWS access key they minted stays valid for weeks. GitHub does not revoke a member's personal access tokens when you remove them from the org. The OAuth grant a former employee authorized two years ago still reads your data, unmonitored. Every one of these is the same class of problem: a credential that is still live but whose owner is gone.
The tools you already run see only one side of it. Prowler and ScoutSuite benchmark one cloud's configuration and will flag an unrotated AWS key, but they live inside AWS and have no concept of your IdP, so they can never say this key's owner was suspended in Okta. Your IdP knows the person was deprovisioned but cannot see the standing cloud credential downstream. Raw asset-inventory layers (CloudQuery, Steampipe, Cartography) hand you the data and leave the join, the identity graph, and the ranking for you to build. Nobody makes the join out of the box.
Afterlife makes exactly that join. It stitches 9 source systems into one identity graph, links a person's AWS IAM user to their Okta identity by shared email and Vault alias, and fires OFFBOARDED-OWNER the moment any linked identity is deprovisioned while the credential stays active. That cross-source correlation is the whole product, and it runs self-hosted so your keys never leave your box.
Each was some version of a live credential behind an absent or compromised owner.
The join no single-source tool can see
One person, seven systems. Afterlife links them by lowercased email and Vault alias, so a live cloud key and a deprovisioned account become one node. The cyan edge is the cross-source correlation your CSPM and IdP structurally cannot make.
16 detection rules, every one free forever
Severities as shipped in v0.3 and confirmed against the detection docs: 5 Critical, 6 High, 4 Medium, 1 Low. Each is a pluggable rule over the graph, ranked by blast radius.
Critical · 5
High · 6
Medium · 4
Low · 1
From nine sources to one ranked list
A layered pipeline: dumb collectors, one identity graph, pluggable rules, explainable scoring, and reports that plug into what you already run.
Self-hosted, by construction
Afterlife runs entirely on your own infrastructure. Collectors use your read-only credentials from the environment and write to a local SQLite file. There is no vendor backend, no telemetry, and no credential custody by design.
Even the commercial layer is offline: a Pro license is an Ed25519-signed token verified locally against an embedded public key. No license server, nothing to call, nothing to leak. Paying for Pro moves no data to the vendor.
Running in about a minute
Python 3.11+. The CLI installs as afterlife.
20 deterministic findings across 8 sources in about a minute (one OFFBOARDED-OWNER, one ADMIN-CONCENTRATION across three systems), and writes an HTML report you can open in a browser.
Scans every source the environment has credentials for, analyzes, and alerts on new ghost access. afterlife serve opens the dashboard; report --format sarif wires it into CI.
Open core
You pay for team, scale, and operational surface, never for detection. Every one of the 16 rules, the identity graph, blast-radius scoring, alerting, and the trends dashboard (with MTTR and burn-down) are free forever. Pro is not the finding, it is the team layer around it: shared authenticated access, ticketing, and signed, tamper-evident audit-evidence packs for your SOC 2 / ISO reviews.
Free forever
- All 9 collectors (AWS, GCP, GitHub, GitLab, Google Workspace, Entra, Okta, Slack, Vault), plus the CloudTrail usage-enrichment pass
- Cross-source identity graph (email and Vault-alias linking)
- All 16 detection rules, ranked by blast radius with explainable factors
- Monitoring with finding history: new, reopened, and resolved across runs
- Alerting to Slack, generic webhook, and email (SMTP)
- run and watch continuous mode, plus the Docker image on GHCR
- Reports in JSON, HTML, SARIF, and PDF
- Local read-only dashboard, allowlist and suppression
Pro
- Dashboard authentication (afterlife serve --require-auth) so you can safely expose it to a team
- Single sign-on via OIDC, behind your own IdP (Google, Okta, Entra, Auth0, Keycloak)
- Jira ticketing: files a remediation issue per new or reopened finding
- Signed, tamper-evident audit-evidence packs (afterlife evidence): an attestable access review your SOC 2 / ISO auditor accepts as-is, with free offline verification
- Unlocked by an offline Ed25519-signed license, verified locally against an embedded public key: no license server, nothing phones home
Secure checkout via Polar. Prefer to talk first? Email us. Activate with AFTERLIFE_LICENSE, verified locally.