flareguard 0.1.0

package/Cargo.toml

@@ -0,0 +1,66 @@
+[package]
+name = "flareguard"
+version = "0.1.0"
+edition = "2024"
+authors = ["Brandon Hubbard <bhubbard@users.noreply.github.com>"]
+description = "Unified Cloudflare Security Guardian — AST secret scanning, Worker binding verification, Zone posture auditing, and origin IP leak hunting."
+license = "MIT"
+readme = "README.md"
+repository = "https://github.com/bhubbard/flareguard"
+homepage = "https://bhubbard.github.io/flareguard"
+keywords = ["cloudflare", "security", "waf", "workers", "cli"]
+categories = ["command-line-utilities", "development-tools"]
+
+[lib]
+name = "flareguard"
+path = "src/lib.rs"
+
+[[bin]]
+name = "flareguard"
+path = "src/main.rs"
+
+[dependencies]
+# CLI & Args
+clap = { version = "4.5", features = ["derive", "cargo", "env"] }
+clap_complete = "4.5"
+
+# Async & Networking
+tokio = { version = "1.43", features = ["full"] }
+reqwest = { version = "0.12", features = ["json"] }
+futures = "0.3"
+hickory-resolver = "0.26"
+
+# Parallelism & Performance
+rayon = "1.10"
+memmap2 = "0.9"
+
+# Serialization & Formats
+serde = { version = "1.0", features = ["derive"] }
+serde_json = "1.0"
+toml = "1.1"
+
+# Terminal Formatting
+colored = "3.0"
+comfy-table = { version = "7.1", features = ["custom_styling"] }
+
+# Pattern Matching & Graph
+regex = "1.11"
+glob = "0.3"
+walkdir = "2.5"
+ipnet = "2.12"
+sha2 = "0.10"
+hex = "0.4"
+chrono = { version = "0.4", features = ["serde"] }
+
+# OXC AST Parser for JS/TS
+oxc_allocator = "0.146.0"
+oxc_ast = "0.146.0"
+oxc_parser = "0.146.0"
+oxc_span = "0.146.0"
+
+# Error Handling
+thiserror = "2.0"
+anyhow = "1.0"
+
+[dev-dependencies]
+tempfile = "3.17"

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Brandon Hubbard
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,115 @@
+# 🛡️ Flareguard
+
+> **The Unified Cloudflare Security & Architecture Guardian**  
+> High-performance Rust CLI & library providing AST secret scanning, Worker binding verification, Zone security posture auditing, and origin IP leak hunting.
+
+[![CI](https://github.com/bhubbard/flareguard/actions/workflows/ci.yml/badge.svg)](https://github.com/bhubbard/flareguard/actions)
+[![crates.io](https://img.shields.io/crates/v/flareguard.svg)](https://crates.io/crates/flareguard)
+[![npm version](https://img.shields.io/npm/v/flareguard.svg)](https://www.npmjs.com/package/flareguard)
+[![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
+[![GitHub Pages](https://img.shields.io/badge/docs-bhubbard.github.io-blue)](https://bhubbard.github.io/flareguard)
+
+---
+
+## ⚡ The 4 Pillars of Flareguard
+
+| Pillar | Subcommand | Description |
+|---|---|---|
+| **🔑 Secrets** | `flareguard secrets` | High-throughput multithreaded scanner preventing Cloudflare API tokens, Global Keys, and Turnstile secrets from leaking into client bundles or git history. |
+| **⚡ Bindings** | `flareguard bindings` | OXC JavaScript/TypeScript AST scanner that cross-references `wrangler.toml` / `wrangler.jsonc` declarations against actual code usage (D1, KV, R2, Vectorize, Hyperdrive, AI). |
+| **🌐 Zone Audit** | `flareguard zone` | Comprehensive live security posture auditor for Cloudflare zones (SSL/TLS Strict, HSTS, WAF Managed Rules, Bot Fight Mode, DNSSEC, security headers). |
+| **🎯 Origin Hunter** | `flareguard origin` | Probes and discovers unmasked backend origin IPs behind Cloudflare reverse proxies using DNS SPF/MX records, CRT.sh Certificate Transparency logs, and active HTTP signatures. |
+
+---
+
+
+## 🔑 Supported Secret Detection Rules (15 Built-in Rules)
+
+| Rule ID | Name | Severity | Description |
+|---|---|---|---|
+| **CF-001** | Cloudflare API Token | `CRITICAL` | Scoped API token (40 characters) |
+| **CF-002** | Cloudflare Global API Key | `CRITICAL` | Legacy global account key (37-hex characters) |
+| **CF-003** | Cloudflare Origin CA Key | `CRITICAL` | Origin certificate creation key (`v1.0-` prefix) |
+| **CF-004** | Cloudflare Turnstile Secret Key | `CRITICAL` | Server-side verification secret (`0x4AAAA...`) |
+| **CF-005** | Zero Trust Access Service Token | `CRITICAL` | Service token secret for Zero Trust policies |
+| **CF-006** | Cloudflare Account ID Context | `MEDIUM` | Account ID assigned in sensitive config contexts |
+| **CF-007** | R2 / S3 Secret Access Key | `CRITICAL` | Object storage secret key (40 characters) |
+| **CF-008** | Database URI / D1 Secret | `CRITICAL` | Embedded Postgres/MySQL connection string or D1 token |
+| **CF-009** | Standalone High-Entropy Token | `HIGH` | High Shannon-entropy token matching Cloudflare signatures |
+| **CF-010** | Hyperdrive Origin Secret | `CRITICAL` | Database credentials or pooling passwords |
+| **CF-011** | Cloudflare Tunnel Token | `CRITICAL` | `cloudflared` ingress tunnel credentials (`eyJh...`) |
+| **CF-012** | AI Gateway & LLM API Key | `CRITICAL` | AI Gateway token, OpenAI (`sk-proj`), Anthropic (`sk-ant`), Gemini (`AIzaSy`) |
+| **CF-013** | Vectorize Admin Secret | `CRITICAL` | Vector database index management key |
+| **CF-014** | Email / MailChannels Secret | `HIGH` | DKIM / transactional mail dispatch credentials |
+| **CF-015** | SSL/TLS Private Key | `CRITICAL` | Unencrypted RSA/EC private key (`BEGIN PRIVATE KEY`) |
+
+## 🚀 Installation & Quickstart
+
+```bash
+# Install via Cargo (Rust)
+cargo install flareguard
+
+# Or install globally via npm
+npm install -g flareguard
+
+# Or run directly via npx without installation
+npx flareguard --help
+
+# Or build from source
+git clone https://github.com/bhubbard/flareguard.git
+cd flareguard
+cargo build --release
+```
+
+### 1. Scan for Leaked Cloudflare Secrets
+```bash
+# Scan static build directory (e.g. dist, public)
+flareguard secrets dist/
+
+# Run in CI mode (fails with exit code 1 on leaks)
+flareguard secrets dist/ --check --format sarif --output results.sarif
+```
+
+### 2. Validate Worker / Pages Bindings
+```bash
+# Validate wrangler.jsonc or wrangler.toml against src/ AST usage
+flareguard bindings src/ --config wrangler.jsonc --strict
+```
+
+### 3. Audit Cloudflare Zone Security
+```bash
+# Live zone audit via API Token
+flareguard zone --token $CF_API_TOKEN --zone example.com --check
+
+# Offline mock audit
+flareguard zone --mock
+```
+
+### 4. Hunt for Unmasked Origin IPs
+```bash
+# Scan domain for direct-to-origin leak vectors
+flareguard origin example.com --check
+
+# Offline mock scan
+flareguard origin --mock
+```
+
+### 5. End-to-End Workspace Check
+```bash
+# Run all local security checks across repository
+flareguard check .
+```
+
+---
+
+## 📜 Architecture & Core Principles
+
+- **Zero-Latency Parallelism:** Rayon-powered parallel directory traversal and memory-mapped file inspection (`memmap2`).
+- **Precision AST Analysis:** Powered by **OXC** (Oxford JavaScript Compiler in Rust) for nanosecond JS/TS parsing without runtime node/v8 dependencies.
+- **Actionable Remediation:** Every finding includes clear, copy-paste shell commands and Cloudflare dashboard remediation instructions.
+- **Enterprise CI/CD Integration:** Direct SARIF output for GitHub Actions Code Scanning and customizable compliance gates.
+
+---
+
+## 📄 License
+MIT © 2026 Brandon Hubbard ([brandonhubbard.com](https://brandonhubbard.com))

package/bin/flareguard.js

@@ -0,0 +1,78 @@
+#!/usr/bin/env node
+import { spawnSync } from "node:child_process";
+import fs from "node:fs";
+import { createRequire } from "node:module";
+import path from "node:path";
+import process from "node:process";
+import { fileURLToPath } from "node:url";
+
+const require = createRequire(import.meta.url);
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const root = path.resolve(__dirname, "..");
+const exe = process.platform === "win32" ? "flareguard.exe" : "flareguard";
+
+const PLATFORM_PACKAGES = {
+  "darwin-arm64": "@flareguard/darwin-arm64",
+  "darwin-x64": "@flareguard/darwin-x64",
+  "linux-x64": "@flareguard/linux-x64",
+  "linux-arm64": "@flareguard/linux-arm64",
+  "win32-x64": "@flareguard/win32-x64",
+};
+
+export function getBinaryPath() {
+  if (process.env.FLAREGUARD_BIN && fs.existsSync(process.env.FLAREGUARD_BIN)) {
+    return process.env.FLAREGUARD_BIN;
+  }
+
+  // 1. Check if optional platform-specific package is installed
+  const platformKey = `${process.platform}-${process.arch}`;
+  const pkgName = PLATFORM_PACKAGES[platformKey];
+  if (pkgName) {
+    try {
+      const resolved = require.resolve(`${pkgName}/bin/${exe}`);
+      if (fs.existsSync(resolved)) {
+        return resolved;
+      }
+    } catch {
+      // Platform package not present; fall through
+    }
+  }
+
+  // 2. Check local builds or vendored binary locations
+  const candidates = [
+    path.resolve(root, "dist/bin", exe),
+    path.resolve(root, "target/release", exe),
+    path.resolve(root, "target/debug", exe),
+  ];
+
+  for (const candidate of candidates) {
+    if (fs.existsSync(candidate)) {
+      if (process.platform !== "win32") {
+        try {
+          const mode = fs.statSync(candidate).mode;
+          if ((mode & 0o111) === 0) {
+            fs.chmodSync(candidate, 0o755);
+          }
+        } catch {
+          // Ignore
+        }
+      }
+      return candidate;
+    }
+  }
+
+  return exe;
+}
+
+const bin = getBinaryPath();
+const res = spawnSync(bin, process.argv.slice(2), { stdio: "inherit" });
+if (res.error) {
+  if (res.error.code === "ENOENT") {
+    console.error(`[flareguard] Could not find native binary '${bin}'.`);
+    console.error("Please run `cargo build --release` or install flareguard via Cargo or prebuilt npm platform package.");
+  } else {
+    console.error(`[flareguard] Execution error: ${res.error.message}`);
+  }
+  process.exit(1);
+}
+process.exit(res.status ?? 0);

package/package.json

@@ -0,0 +1,50 @@
+{
+  "name": "flareguard",
+  "version": "0.1.0",
+  "description": "Unified Cloudflare Security Guardian — AST secret scanning, Worker binding verification, Zone posture auditing, and origin IP leak hunting.",
+  "keywords": [
+    "cloudflare",
+    "security",
+    "waf",
+    "workers",
+    "cli",
+    "secrets",
+    "audit"
+  ],
+  "homepage": "https://bhubbard.github.io/flareguard",
+  "bugs": {
+    "url": "https://github.com/bhubbard/flareguard/issues"
+  },
+  "license": "MIT",
+  "author": "Brandon Hubbard <bkhubbard@gmail.com>",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/bhubbard/flareguard.git"
+  },
+  "bin": {
+    "flareguard": "bin/flareguard.js"
+  },
+  "files": [
+    "bin",
+    "scripts/postinstall.mjs",
+    "Cargo.toml",
+    "Cargo.lock",
+    "src",
+    "README.md",
+    "LICENSE"
+  ],
+  "type": "module",
+  "scripts": {
+    "build:cargo": "cargo build --release",
+    "postinstall": "node scripts/postinstall.mjs",
+    "prepare:publish": "node scripts/set-optional-deps.mjs",
+    "test": "cargo test"
+  },
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "//optionalDependencies": [
+    "The @flareguard/* prebuilt-binary packages are attached at publish",
+    "time by scripts/set-optional-deps.mjs, not committed here."
+  ]
+}

package/scripts/postinstall.mjs

@@ -0,0 +1,83 @@
+#!/usr/bin/env node
+import { spawnSync } from "node:child_process";
+import fs from "node:fs";
+import { createRequire } from "node:module";
+import path from "node:path";
+import process from "node:process";
+import { fileURLToPath } from "node:url";
+
+const require = createRequire(import.meta.url);
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+const exe = process.platform === "win32" ? "flareguard.exe" : "flareguard";
+
+const PLATFORM_PACKAGES = {
+  "darwin-arm64": "@flareguard/darwin-arm64",
+  "darwin-x64": "@flareguard/darwin-x64",
+  "linux-x64": "@flareguard/linux-x64",
+  "linux-arm64": "@flareguard/linux-arm64",
+  "win32-x64": "@flareguard/win32-x64",
+};
+
+function log(message) {
+  console.log(`[flareguard] ${message}`);
+}
+
+function runnable(file) {
+  if (!fs.existsSync(file)) return false;
+  const res = spawnSync(file, ["--version"], { stdio: "ignore", timeout: 10_000 });
+  return !res.error && res.status === 0;
+}
+
+function alreadyPresent() {
+  const pkg = PLATFORM_PACKAGES[`${process.platform}-${process.arch}`];
+  if (pkg) {
+    try {
+      if (runnable(require.resolve(`${pkg}/bin/${exe}`))) return true;
+    } catch {
+      // Not installed; keep looking
+    }
+  }
+
+  return ["dist/bin", "target/release"].some((dir) => runnable(path.join(root, dir, exe)));
+}
+
+function hasCargo() {
+  const res = spawnSync("cargo", ["--version"], { stdio: "ignore" });
+  return res.status === 0;
+}
+
+function main() {
+  if (alreadyPresent()) return;
+
+  if (!hasCargo()) {
+    log(
+      `No prebuilt binary found for ${process.platform}-${process.arch} and cargo is not installed.\n` +
+        `  To build from source, install Rust (https://rustup.rs) and run \`cargo build --release\`,\n` +
+        `  or set FLAREGUARD_BIN to an existing flareguard binary.`,
+    );
+    return;
+  }
+
+  log("No prebuilt binary for this platform — compiling with cargo...");
+  const res = spawnSync("cargo", ["build", "--release"], { cwd: root, stdio: "inherit" });
+
+  if (res.status !== 0) {
+    log("cargo build failed. Run `cargo build --release` manually to see the error.");
+    return;
+  }
+
+  const built = path.join(root, "target", "release", exe);
+  const destDir = path.join(root, "dist", "bin");
+  if (fs.existsSync(built)) {
+    fs.mkdirSync(destDir, { recursive: true });
+    fs.copyFileSync(built, path.join(destDir, exe));
+    if (process.platform !== "win32") fs.chmodSync(path.join(destDir, exe), 0o755);
+    log("Engine built successfully.");
+  }
+}
+
+try {
+  main();
+} catch (err) {
+  log(`Postinstall skipped: ${err.message}`);
+}