The evidence pack is a signed, portable bundle of every finding mapped to compliance frameworks (OWASP, CWE, CIS, SOC 2, NIST, ISO, GDPR) plus the “Audited with Granska” attestation badge — the deliverable auditors and due-diligence reviewers actually want. Detection and the audit itself stay free; generating the pack is the Pro feature (see pricing).

1. Buy Pro

Get Pro — $39/repo/mo via the checkout on the pricing page. Polar issues a license key immediately after checkout.

2. Set your license key

export GRANSKA_LICENSE_KEY=<your-key>

3. Generate the pack

node bin/evidence-pack.mjs <run-dir>

<run-dir> is the output directory from a prior /audit run (the one containing report.json). A valid key unlocks pack generation immediately; an invalid or missing key exits non-zero with a clear message pointing back to granska.dev/pricing — never a silent failure, never a crash.

Offline verification

The pack’s attestation is independently verifiable offline via cosign — no Granska-hosted verification server. See the repo’s evidence documentation for the full granska verify walkthrough.