Chime's Monocle: Automating Security at Scale

 David Trejo's BSides SF presentation introduced Monocle, an internal Rails application developed at Chime to address security scaling challenges as their engineering team expanded. Monocle assigns letter grades to code repositories based on factors including approved base images, branch protection, vulnerability resolution, and test coverage, displaying these grades via badges directly in repositories. The system performs nightly security score recalculations, monitors pull requests for security rule compliance, and automatically creates JIRA tickets for violations, saving approximately 2,000 engineering hours annually on audits. It communicates through monthly security scorecards sent to team Slack channels and provides dashboards showing security posture across services, meeting engineers where they work - in GitHub, Slack, and their editors. The system's key benefits include gamifying security best practices, reducing engineer stress around compliance, providing clear visibility for leadership, and making security initiatives easier to roll out while empowering engineers to be security champions. Trejo suggested organizations interested in similar solutions could start small with automated Slack notifications or consider open-source alternatives like OSSF's AllStar or Backstage.io, noting that while Chime expressed interest in open-sourcing Monocle, it hadn't been released at the time of the presentation.

https://www.youtube.com/watch?v=gt9EtpsA2lY