Support Pavois
Pavois is built and maintained by one person, on personal time. Free, with no ads and no tracking. Here is what supporting it changes.
A personal project
There is no company behind Pavois, no team and no funding. One person, on their own time, evenings and weekends.
What this tool costs
789 controls written and verified one by one, 2,729 standard references tied by hand to the official texts, 9 Linux systems maintained in parallel, and a hardening engine that has to work on real machines without breaking them.
This is not development time in the usual sense. Most of it goes into verification: provision a fresh machine, harden it, reboot, re-scan, work out why a control fails, and start again. It is slow, and it is the only way to produce a compliance tool anyone can rely on.
What stays free
Everything. The binary, the rule base, the documentation, the OSCAL exports. No paid tier, no reserved feature, no advertising and no ad tracker. Audience measurement uses self-hosted Plausible, with no cookie and no personal data.
Supporting with money
Any support, even a symbolic one, covers hosting and the test infrastructure, and above all it says the tool is useful to someone. That is what decides whether it continues.
Supporting without spending
These are worth as much, sometimes more, and that is meant literally:
- Report a bug. A compliance tool that is wrong is worse than useless: one field report is worth hours of review. Open an issue
- Say which system you ran it on and what happened. The support matrix is built from real machines, not from assumptions.
- Mention it to colleagues, or cite it if you write about Linux hardening.
Who writes this
Stéphane Robert, DevOps engineer. I also write guides on blog.stephane-robert.info, more than 700 free articles on security, automation and DevSecOps practice. You can follow along on LinkedIn.