layer8-secretscan 0.1.0__py3-none-any.whl

layer8_secretscan-0.1.0.dist-info/METADATA

@@ -0,0 +1,91 @@
+Metadata-Version: 2.4
+Name: layer8-secretscan
+Version: 0.1.0
+Summary: Scan your machine for accidentally exposed secrets — API keys, tokens, passwords, private keys — across filesystem, shell history, keychain, processes, and more.
+License-Expression: MIT
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+Requires-Dist: pyyaml>=6.0
+Provides-Extra: chrome
+Requires-Dist: websocket-client>=1.6.0; extra == "chrome"
+Requires-Dist: cryptography>=41.0; extra == "chrome"
+Provides-Extra: all
+Requires-Dist: websocket-client>=1.6.0; extra == "all"
+Requires-Dist: cryptography>=41.0; extra == "all"
+
+# secretscan
+
+A personal security-hygiene tool: scans your own machine for accidentally
+exposed secrets (API keys, tokens, passwords, private keys), audits what's
+installed and what's exposed (Docker containers, listening ports), and can
+optionally check your local network and internet connectivity.
+
+## Install
+
+```sh
+pip install .
+```
+
+Or for development:
+
+```sh
+pip install -e .
+```
+
+## Usage
+
+```sh
+# default scan: everything except lan/internet, print a table
+secretscan run
+
+# scan a specific directory, filesystem module only
+secretscan run --paths ~/Projects --modules filesystem
+
+# full scan including LAN and internet, all formats
+secretscan run --modules filesystem,shell-history,keychain,process-env,installed-tools,network,docker,lan,internet \
+  --yes-lan --format table,json,html --output-dir ./report
+
+# list all detection rules
+secretscan rules list
+
+# use a custom rules file
+secretscan run --rules-file my-rules.yaml
+```
+
+## Modules
+
+| Module | Default | What it does |
+|---|---|---|
+| `filesystem` | yes | Scans files under `--paths` (default `$HOME`) for secret patterns |
+| `shell-history` | yes | Scans `.zsh_history`, `.bash_history`, and other history files |
+| `keychain` | yes | Audits macOS Keychain metadata (never decrypts values) |
+| `process-env` | yes | Inspects your own running processes' command lines |
+| `installed-tools` | yes | Inventories security/dev tools and packages |
+| `network` | yes | Lists TCP/UDP ports this machine is listening on |
+| `docker` | yes | Lists running containers, checks for exposed Docker API |
+| `lan` | opt-in | Probes other devices on your local network (`--yes-lan`) |
+| `internet` | opt-in | Tests outbound connectivity to public endpoints |
+
+## Output formats
+
+- `table` — colored terminal output (default)
+- `json` — machine-readable `{meta, findings}` document
+- `html` — self-contained HTML report with dark/light theme
+- `csv` — flat CSV of findings
+
+## Detection
+
+14 built-in rules covering AWS, GitHub, GitLab, Slack, Stripe, Google, npm,
+PEM private keys, and generic password/secret/token assignments. Each rule
+uses regex matching with optional Shannon entropy scoring and keyword
+pre-filtering for performance.
+
+Values that look like placeholders (`{{password}}`, `changeme`, `your_api_key_here`)
+are detected and downgraded rather than competing with real findings.
+
+## What this tool does NOT do
+
+- No git-history scanning (use Gitleaks/TruffleHog for that)
+- No live credential verification
+- No bypassing macOS security prompts
+- Secret detection modules never make outbound network calls

layer8_secretscan-0.1.0.dist-info/RECORD

@@ -0,0 +1,35 @@
+secretscan/__init__.py,sha256=kUR5RAFc7HCeiqdlX36dZOHkUI5wI6V_43RpEcD8b-0,22
+secretscan/__main__.py,sha256=Txo6AmotoWSA88hTtJWGXhBq57Litv0NlL8BbL-pO_g,40
+secretscan/cli.py,sha256=gpZmaHHF8qVUNMXNePjVkWyAHsloL2DtLXSB9ldzQo4,9812
+secretscan/config.py,sha256=qG7iLGv_1QB6noUu5yRqZ8t1BQd3PQd9Rhdd25n7-5g,5617
+secretscan/model.py,sha256=6xdtZWHigu4uXS-cb3I56xcidnqSDyptEBbAmt3fMbY,11284
+secretscan/redact.py,sha256=rXVsCbhk9D3T-a6TsSINHzSrrL3SoHAsces2bmg4FPs,966
+secretscan/report/__init__.py,sha256=ayQzC52-LvEjv5i_JvRsavFpfsopfOhEMMljhbWIWgs,288
+secretscan/report/csv_report.py,sha256=1h_1KT4Qqpsnt9TLu6mcGQpBy9cRn-pACavqI-eHRCk,770
+secretscan/report/html_report.py,sha256=9ro63ptpip3HGxGywijMq4GMcH2C3uZT4GQlaXJmxKI,10016
+secretscan/report/json_report.py,sha256=nqDur5XHBVgrZWTYL5bZBmxHjH1aCPUhSysJWvnTMxA,349
+secretscan/report/table_report.py,sha256=Sw4JooHWm4QwJhadsRSXF_32IZl3WlVKNoF-ez2pLlY,5924
+secretscan/rules/__init__.py,sha256=WYIZyRuVRokHAduEw099sw8tBAAO_nmBYY85qdznLVQ,411
+secretscan/rules/default.yaml,sha256=R7rkb0zpOen6qn2oeqzC_WrpCUaRwgOF64yY3xW59Ss,3762
+secretscan/rules/entropy.py,sha256=rnSHtaE2-Lk36bQOSz5svcxo9ffYVMWKocNmINLVvqk,359
+secretscan/rules/loader.py,sha256=PpeirWUIMTvYPLAHTqrEuNr8sUbpnOFelz8Sb84JIPU,995
+secretscan/rules/placeholder.py,sha256=bSuyIvzv8kJ5xj6FCOVcE8O9SY-zbcL8CfKZE7TN-sU,1984
+secretscan/rules/rule.py,sha256=vrvkZyQdwOuTBIXov2Lo_XlY3y0U5sZrnrVksO8FlFg,2119
+secretscan/scanner/__init__.py,sha256=EqA1Am5FgeskkVYk_409EiwpIfPHLLuJZbDytUPeyAU,71
+secretscan/scanner/chrome.py,sha256=xYGwM28eRVMb8xmkmSK9CGcxGjQGeiiWsXuZZyuRmyA,18286
+secretscan/scanner/content.py,sha256=aYLh9o0VnTlwmlCjZgpQzL36qi75V-XG_fy8KnGXuio,3206
+secretscan/scanner/docker.py,sha256=XjEqVxJGDZnb2MZB5-KzF8m6kFRlwQf4PGgQeZX19XM,2597
+secretscan/scanner/engine.py,sha256=EMDK92kzuXNfC_bxAnwqqf6sNb1Vts1Gi6JFm2Qx1RQ,5730
+secretscan/scanner/filesystem.py,sha256=5-53zkzrtEEl0YLrlJO8RnmGFPQLq8OhISVoiNPTjIE,8431
+secretscan/scanner/internet.py,sha256=r2wxfnZAC6Yt0pwJgRzBBaYqNrZihvbkKUpXIOTwDDk,1629
+secretscan/scanner/keychain.py,sha256=sCiswBE8cfH37YjbrDjt2Ojd5asmpjlgvOCbWYNWjqk,3962
+secretscan/scanner/lan.py,sha256=_nscxBONOwOeO497bkbH5GwrjvCOVphV3QZgCpBSpcc,6047
+secretscan/scanner/network.py,sha256=bTXqV-rJpjQ69y6m-zik_rTjW5mwh_JrQpG9_UHzdu8,4513
+secretscan/scanner/process_env.py,sha256=mysqt68Al_6XeUvTSJs3a80dNGchfdNb9YB71ta4vYo,4023
+secretscan/scanner/shell_history.py,sha256=GbnvENHNBxWyssx-dDOkTpN6GJi31m0p4Vd8riq7HKY,1941
+secretscan/scanner/tools.py,sha256=F7BB823E0Eyhb0dnm37Y_VjTi3QRXPBBEahFZxU61gg,5269
+layer8_secretscan-0.1.0.dist-info/METADATA,sha256=T5woTB7M4-hYNcNc-ibzscyVKovAOIb65tcFP2kK0BI,3196
+layer8_secretscan-0.1.0.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
+layer8_secretscan-0.1.0.dist-info/entry_points.txt,sha256=sN0WNeqqwlhtqW4JeXpFhvTbL1NWCC3XamQwJ4lbBTc,51
+layer8_secretscan-0.1.0.dist-info/top_level.txt,sha256=zslsakZH5pTIXMMAMAfZm8DyVItULqPac_Dxi-rDaL4,11
+layer8_secretscan-0.1.0.dist-info/RECORD,,

layer8_secretscan-0.1.0.dist-info/WHEEL

@@ -0,0 +1,5 @@
+Wheel-Version: 1.0
+Generator: setuptools (84.0.0)
+Root-Is-Purelib: true
+Tag: py3-none-any
+

layer8_secretscan-0.1.0.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+secretscan = secretscan.cli:main

layer8_secretscan-0.1.0.dist-info/top_level.txt

@@ -0,0 +1 @@
+secretscan

secretscan/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.1.0"

secretscan/__main__.py

@@ -0,0 +1,3 @@
+from secretscan.cli import main
+
+main()

secretscan/cli.py

@@ -0,0 +1,243 @@
+from __future__ import annotations
+
+import argparse
+import os
+import sys
+from datetime import datetime
+from pathlib import Path
+
+from secretscan import __version__
+from secretscan.config import Config
+from secretscan.model import Confidence, Module, Severity, DEFAULT_MODULES, OPT_IN_MODULES
+
+
+MODULE_NAMES = {
+    "filesystem": Module.FILESYSTEM,
+    "shell-history": Module.SHELL_HISTORY,
+    "keychain": Module.KEYCHAIN,
+    "process-env": Module.PROCESS_ENV,
+    "installed-tools": Module.INSTALLED_TOOLS,
+    "network": Module.NETWORK,
+    "docker": Module.DOCKER,
+    "chrome": Module.CHROME,
+    "lan": Module.LAN,
+    "internet": Module.INTERNET,
+}
+
+BAR_WIDTH = 30
+
+
+def _progress_bar(done: int, total: int, module_name: str = "") -> None:
+    if total == 0:
+        return
+    pct = int(done / total * 100)
+    filled = int(BAR_WIDTH * done / total)
+    bar = "█" * filled + "░" * (BAR_WIDTH - filled)
+    label = f" {module_name}" if module_name else ""
+    sys.stderr.write(f"\r  [{bar}] {pct:3d}% ({done}/{total}){label}  ")
+    sys.stderr.flush()
+    if done == total:
+        sys.stderr.write("\n")
+
+
+def _render_outputs(cfg: Config, result) -> None:
+    for fmt in cfg.formats:
+        if fmt == "json":
+            from secretscan.report.json_report import render_json
+            if cfg.output_dir:
+                os.makedirs(cfg.output_dir, exist_ok=True)
+                with open(os.path.join(cfg.output_dir, "report.json"), "w") as f:
+                    render_json(f, result.findings, result.meta)
+            else:
+                render_json(sys.stdout, result.findings, result.meta)
+        elif fmt == "html":
+            from secretscan.report.html_report import render_html
+            if cfg.output_dir:
+                os.makedirs(cfg.output_dir, exist_ok=True)
+                with open(os.path.join(cfg.output_dir, "report.html"), "w") as f:
+                    render_html(f, result.findings, result.meta)
+                sys.stderr.write(f"  HTML report written to {cfg.output_dir}/report.html\n")
+            else:
+                render_html(sys.stdout, result.findings, result.meta)
+        elif fmt == "csv":
+            from secretscan.report.csv_report import render_csv
+            if cfg.output_dir:
+                os.makedirs(cfg.output_dir, exist_ok=True)
+                with open(os.path.join(cfg.output_dir, "report.csv"), "w") as f:
+                    render_csv(f, result.findings, result.meta)
+            else:
+                render_csv(sys.stdout, result.findings, result.meta)
+        elif fmt == "table":
+            from secretscan.report.table_report import render_table
+            render_table(sys.stderr, result.findings, result.meta, no_color=False)
+
+
+def _run(args: argparse.Namespace) -> int:
+    from secretscan.scanner.engine import run_scan
+
+    modules: list[Module] = []
+    if args.modules:
+        for name in args.modules.split(","):
+            name = name.strip()
+            try:
+                modules.append(Module(name))
+            except ValueError:
+                sys.stderr.write(f"unknown module: {name}\n")
+                return 2
+    else:
+        modules = list(DEFAULT_MODULES)
+
+    if args.yes_lan and Module.LAN not in modules:
+        modules.append(Module.LAN)
+
+    if Module.LAN in modules and not args.yes_lan:
+        sys.stderr.write(
+            "  The 'lan' module actively probes other devices on your network.\n"
+            "  Pass --yes-lan to confirm you're authorized to scan that network.\n"
+        )
+        modules = [m for m in modules if m != Module.LAN]
+
+    if Module.INTERNET in modules:
+        sys.stderr.write("  The 'internet' module makes real outbound calls to public endpoints.\n")
+
+    paths = args.paths.split(",") if args.paths else [str(Path.home())]
+
+    cfg = Config(
+        paths=paths,
+        modules=modules,
+        exclude_globs=args.exclude.split(",") if args.exclude else [],
+        no_default_excludes=args.no_default_excludes,
+        include_volumes=args.include_volumes,
+        min_severity=Severity(args.min_severity),
+        min_confidence=Confidence(args.min_confidence),
+        rules_file=args.rules_file or "",
+        concurrency=args.concurrency,
+        reveal_length=args.reveal_length,
+        formats=args.format.split(",") if args.format else ["table"],
+        output_dir=args.output_dir or "",
+    )
+
+    module_order = list(cfg.modules)
+
+    def progress(done: int, total: int) -> None:
+        mod_name = module_order[done - 1].value if done <= len(module_order) else ""
+        _progress_bar(done, total, mod_name)
+
+    result = run_scan(cfg, progress=progress)
+    _render_outputs(cfg, result)
+    return 1 if result.findings else 0
+
+
+def _fullscan(args: argparse.Namespace) -> int:
+    from secretscan.scanner.engine import run_scan
+
+    all_modules = list(Module)
+
+    output_dir = args.output_dir
+    if not output_dir:
+        output_dir = str(Path("reports") / datetime.now().strftime("%Y-%m-%d_%H-%M-%S"))
+
+    paths = args.paths.split(",") if args.paths else [str(Path.home())]
+
+    cfg = Config(
+        paths=paths,
+        modules=all_modules,
+        rules_file=args.rules_file or "",
+        concurrency=args.concurrency,
+        reveal_length=args.reveal_length,
+        formats=["html", "json", "table"],
+        output_dir=output_dir,
+    )
+
+    sys.stderr.write(f"\n  secretscan fullscan\n")
+    sys.stderr.write(f"  Paths: {', '.join(paths)}\n")
+    sys.stderr.write(f"  Modules: {', '.join(m.value for m in all_modules)}\n")
+    sys.stderr.write(f"  Output: {output_dir}\n\n")
+
+    module_order = list(cfg.modules)
+
+    def progress(done: int, total: int) -> None:
+        mod_name = module_order[done - 1].value if done <= len(module_order) else ""
+        _progress_bar(done, total, mod_name)
+
+    result = run_scan(cfg, progress=progress)
+    _render_outputs(cfg, result)
+
+    html_path = os.path.join(output_dir, "report.html")
+    if os.path.isfile(html_path):
+        sys.stderr.write(f"\n  Report: {html_path}\n")
+
+    return 1 if result.findings else 0
+
+
+def _rules_list(args: argparse.Namespace) -> int:
+    from secretscan.rules.loader import load_default_rules, load_rules_file
+
+    if args.rules_file:
+        rules = load_rules_file(args.rules_file)
+    else:
+        rules = load_default_rules()
+
+    fmt = "{:<35s} {:<10s} {:<50s}"
+    sys.stdout.write(fmt.format("ID", "SEVERITY", "DESCRIPTION") + "\n")
+    sys.stdout.write("─" * 95 + "\n")
+    for r in rules:
+        sys.stdout.write(
+            fmt.format(r.rule.id, r.rule.severity, r.rule.description[:50]) + "\n"
+        )
+    sys.stdout.write(f"\n{len(rules)} rules loaded.\n")
+    return 0
+
+
+def main(argv: list[str] | None = None) -> None:
+    parser = argparse.ArgumentParser(
+        prog="secretscan",
+        description="Scan your machine for accidentally exposed secrets.",
+    )
+    parser.add_argument("--version", action="version", version=f"secretscan {__version__}")
+    subparsers = parser.add_subparsers(dest="command")
+
+    # --- run ---
+    run_parser = subparsers.add_parser("run", help="Run a scan with selected modules")
+    run_parser.add_argument("--paths", default=None, help="Comma-separated roots to scan (default: $HOME)")
+    run_parser.add_argument("--modules", default=None, help="Comma-separated modules to run")
+    run_parser.add_argument("--exclude", default=None, help="Additional glob patterns to exclude")
+    run_parser.add_argument("--no-default-excludes", action="store_true")
+    run_parser.add_argument("--include-volumes", action="store_true", help="Include /Volumes mounts")
+    run_parser.add_argument("--yes-lan", action="store_true", help="Confirm LAN probing authorization")
+    run_parser.add_argument("--min-severity", default="low", choices=["low", "medium", "high", "critical"])
+    run_parser.add_argument("--min-confidence", default="low", choices=["low", "medium", "high"])
+    run_parser.add_argument("--rules-file", default=None, help="Custom rules YAML file")
+    run_parser.add_argument("--format", default="table", help="Output formats: table,json,html,csv")
+    run_parser.add_argument("--output-dir", default=None, help="Write file reports to this directory")
+    run_parser.add_argument("--reveal-length", action="store_true", help="Show coarse length hint on redacted values")
+    run_parser.add_argument("--concurrency", type=int, default=0, help="Worker threads (default: CPU count)")
+    run_parser.add_argument("--no-color", action="store_true", help="Disable ANSI colors in table output")
+
+    # --- fullscan ---
+    full_parser = subparsers.add_parser("fullscan", help="Run ALL modules (incl. Chrome, LAN, Internet) and generate HTML+JSON reports")
+    full_parser.add_argument("--paths", default=None, help="Comma-separated roots to scan (default: $HOME)")
+    full_parser.add_argument("--output-dir", default=None, help="Write reports here (default: reports/<timestamp>)")
+    full_parser.add_argument("--rules-file", default=None, help="Custom rules YAML file")
+    full_parser.add_argument("--reveal-length", action="store_true")
+    full_parser.add_argument("--concurrency", type=int, default=0)
+
+    # --- rules ---
+    rules_parser = subparsers.add_parser("rules", help="Manage detection rules")
+    rules_sub = rules_parser.add_subparsers(dest="rules_command")
+    list_parser = rules_sub.add_parser("list", help="List all detection rules")
+    list_parser.add_argument("--rules-file", default=None)
+
+    parsed = parser.parse_args(argv)
+
+    if parsed.command == "run":
+        code = _run(parsed)
+    elif parsed.command == "fullscan":
+        code = _fullscan(parsed)
+    elif parsed.command == "rules" and getattr(parsed, "rules_command", None) == "list":
+        code = _rules_list(parsed)
+    else:
+        parser.print_help()
+        code = 0
+
+    sys.exit(code)

secretscan/config.py

@@ -0,0 +1,187 @@
+from __future__ import annotations
+
+import platform
+from dataclasses import dataclass, field
+from pathlib import Path
+
+from secretscan.model import Confidence, Module, Severity
+
+_COMMON_EXCLUDES = [
+    "**/.git/**",
+    "**/node_modules/**",
+    "**/vendor/**",
+    "**/.venv/**",
+    "**/__pycache__/**",
+    "**/.Trash/**",
+    "**/.claude/file-history/**",
+    "**/.claude/projects/**",
+    "**/.claude/shell-snapshots/**",
+    "**/.claude/todos/**",
+    "**/.claude/plugins/**",
+    "**/.codex/.tmp/**",
+    "**/go/pkg/mod/**",
+    "**/google-cloud-sdk/**",
+    "**/.cache/uv/**",
+    "**/.cache/pip/**",
+    "**/.cache/yarn/**",
+    "**/.cache/pnpm/**",
+    "**/.cache/go-build/**",
+    "**/.cache/go-mod/**",
+    "**/.cache/Homebrew/**",
+    "**/.cache/huggingface/**",
+    "**/.cache/torch/**",
+    "**/.cache/matplotlib/**",
+    "**/.cache/mesa_shader_cache/**",
+    "**/.cache/JetBrains/**",
+    "**/.cache/Google/**",
+    "**/.cache/mozilla/**",
+    "**/.cache/chromium/**",
+    "**/.cache/thumbnails/**",
+]
+
+_MACOS_EXCLUDES = [
+    "**/.Spotlight-V100/**",
+    "**/.fseventsd/**",
+    "**/.DocumentRevisions-V100/**",
+    "**/.TemporaryItems/**",
+    "**/Library/Caches/**",
+    "**/Library/Developer/Xcode/DerivedData/**",
+    "**/Library/Developer/CoreSimulator/**",
+    "**/Library/Application Support/Google/**",
+    "**/Library/Application Support/Firefox/**",
+    "**/Library/Application Support/Slack/**",
+    "**/Library/Application Support/Discord/**",
+    "**/Library/Application Support/Microsoft/**",
+    "**/Library/Application Support/Code/**",
+    "**/Library/Application Support/com.apple.*/**",
+    "**/Library/Application Support/Electron/**",
+    "**/Library/Application Support/Steam/**",
+    "**/Library/Application Support/Spotify/**",
+    "**/Library/Application Support/zoom.us/**",
+    "**/Library/Application Support/obsidian/**",
+    "**/Library/Application Support/Brave Browser/**",
+    "**/Library/Application Support/Arc/**",
+    "**/Library/Application Support/JetBrains/**",
+    "**/Library/Application Support/Adobe/**",
+    "**/Library/Application Support/iCloud/**",
+    "**/Library/Application Support/CallHistoryDB/**",
+    "**/Library/Application Support/Knowledge/**",
+    "**/Library/Application Support/AddressBook/**",
+    "**/Library/Application Support/NotificationCenter/**",
+    "**/Library/Mail/**",
+    "**/Library/Messages/**",
+    "**/Library/Containers/**",
+    "**/Library/Group Containers/**",
+    "**/Library/Saved Application State/**",
+    "**/Library/WebKit/**",
+    "**/Library/Safari/**",
+    "**/Library/Metadata/**",
+    "**/Library/Logs/**",
+    "**/Library/Fonts/**",
+    "**/Library/ColorSync/**",
+    "**/Library/Autosave Information/**",
+    "**/Library/HomeKit/**",
+    "**/Library/CoreData/**",
+    "**/Photos Library.photoslibrary/**",
+    "**/Music/Music/**",
+    "**/Movies/**",
+]
+
+_LINUX_EXCLUDES = [
+    "**/proc/**",
+    "**/sys/**",
+    "**/dev/**",
+    "**/run/**",
+    "**/snap/**",
+    "**/lost+found/**",
+    "**/var/log/**",
+    "**/var/cache/**",
+    "**/var/lib/dpkg/**",
+    "**/var/lib/apt/**",
+    "**/var/lib/rpm/**",
+    "**/var/lib/pacman/**",
+    "**/var/lib/docker/**",
+    "**/var/lib/containerd/**",
+    "**/var/lib/snapd/**",
+    "**/var/lib/flatpak/**",
+    "**/var/tmp/**",
+    "**/tmp/**",
+    "**/.local/share/Trash/**",
+    "**/.local/share/Steam/**",
+    "**/.config/google-chrome/Default/Service Worker/**",
+    "**/.config/google-chrome/Default/Cache/**",
+    "**/.mozilla/**",
+]
+
+_WINDOWS_EXCLUDES = [
+    "**/Windows/**",
+    "**/Program Files/**",
+    "**/Program Files (x86)/**",
+    "**/ProgramData/**",
+    "**/AppData/Local/Temp/**",
+    "**/AppData/Local/Microsoft/**",
+    "**/AppData/Local/Google/Chrome/User Data/Default/Service Worker/**",
+    "**/AppData/Local/Google/Chrome/User Data/Default/Cache/**",
+    "**/AppData/Local/Packages/**",
+    "**/AppData/Local/Programs/**",
+    "**/$Recycle.Bin/**",
+    "**/System Volume Information/**",
+    "**/Recovery/**",
+]
+
+
+def _platform_excludes() -> list[str]:
+    system = platform.system()
+    if system == "Darwin":
+        return _MACOS_EXCLUDES
+    elif system == "Linux":
+        return _LINUX_EXCLUDES
+    elif system == "Windows":
+        return _WINDOWS_EXCLUDES
+    return []
+
+
+DEFAULT_EXCLUDE_GLOBS = _COMMON_EXCLUDES + _platform_excludes()
+
+DEFAULT_SHELL_HISTORY_FILES = [
+    ".zsh_history",
+    ".bash_history",
+    ".python_history",
+    ".psql_history",
+    ".mysql_history",
+    ".node_repl_history",
+    ".local/share/fish/fish_history",
+    ".lesshst",
+]
+
+DEFAULT_MAX_FILE_SIZE = 10 * 1024 * 1024  # 10MB
+
+
+@dataclass
+class Config:
+    paths: list[str] = field(default_factory=lambda: [str(Path.home())])
+    modules: list[Module] = field(default_factory=lambda: list(Module))
+    exclude_globs: list[str] = field(default_factory=list)
+    no_default_excludes: bool = False
+    include_volumes: bool = False
+    max_file_size: int = DEFAULT_MAX_FILE_SIZE
+    min_severity: Severity = Severity.LOW
+    min_confidence: Confidence = Confidence.LOW
+    rules_file: str = ""
+    concurrency: int = 0
+    reveal_length: bool = False
+    output_dir: str = ""
+    formats: list[str] = field(default_factory=lambda: ["table"])
+
+    def effective_excludes(self) -> list[str]:
+        if self.no_default_excludes:
+            return list(self.exclude_globs)
+        return DEFAULT_EXCLUDE_GLOBS + list(self.exclude_globs)
+
+    @staticmethod
+    def default() -> Config:
+        from secretscan.model import DEFAULT_MODULES
+        return Config(
+            paths=[str(Path.home())],
+            modules=list(DEFAULT_MODULES),
+        )