Building open source tools for compliance & security