layer8-secretscan 0.1.0__tar.gz

layer8_secretscan-0.1.0/PKG-INFO

@@ -0,0 +1,91 @@
+Metadata-Version: 2.4
+Name: layer8-secretscan
+Version: 0.1.0
+Summary: Scan your machine for accidentally exposed secrets — API keys, tokens, passwords, private keys — across filesystem, shell history, keychain, processes, and more.
+License-Expression: MIT
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+Requires-Dist: pyyaml>=6.0
+Provides-Extra: chrome
+Requires-Dist: websocket-client>=1.6.0; extra == "chrome"
+Requires-Dist: cryptography>=41.0; extra == "chrome"
+Provides-Extra: all
+Requires-Dist: websocket-client>=1.6.0; extra == "all"
+Requires-Dist: cryptography>=41.0; extra == "all"
+
+# secretscan
+
+A personal security-hygiene tool: scans your own machine for accidentally
+exposed secrets (API keys, tokens, passwords, private keys), audits what's
+installed and what's exposed (Docker containers, listening ports), and can
+optionally check your local network and internet connectivity.
+
+## Install
+
+```sh
+pip install .
+```
+
+Or for development:
+
+```sh
+pip install -e .
+```
+
+## Usage
+
+```sh
+# default scan: everything except lan/internet, print a table
+secretscan run
+
+# scan a specific directory, filesystem module only
+secretscan run --paths ~/Projects --modules filesystem
+
+# full scan including LAN and internet, all formats
+secretscan run --modules filesystem,shell-history,keychain,process-env,installed-tools,network,docker,lan,internet \
+  --yes-lan --format table,json,html --output-dir ./report
+
+# list all detection rules
+secretscan rules list
+
+# use a custom rules file
+secretscan run --rules-file my-rules.yaml
+```
+
+## Modules
+
+| Module | Default | What it does |
+|---|---|---|
+| `filesystem` | yes | Scans files under `--paths` (default `$HOME`) for secret patterns |
+| `shell-history` | yes | Scans `.zsh_history`, `.bash_history`, and other history files |
+| `keychain` | yes | Audits macOS Keychain metadata (never decrypts values) |
+| `process-env` | yes | Inspects your own running processes' command lines |
+| `installed-tools` | yes | Inventories security/dev tools and packages |
+| `network` | yes | Lists TCP/UDP ports this machine is listening on |
+| `docker` | yes | Lists running containers, checks for exposed Docker API |
+| `lan` | opt-in | Probes other devices on your local network (`--yes-lan`) |
+| `internet` | opt-in | Tests outbound connectivity to public endpoints |
+
+## Output formats
+
+- `table` — colored terminal output (default)
+- `json` — machine-readable `{meta, findings}` document
+- `html` — self-contained HTML report with dark/light theme
+- `csv` — flat CSV of findings
+
+## Detection
+
+14 built-in rules covering AWS, GitHub, GitLab, Slack, Stripe, Google, npm,
+PEM private keys, and generic password/secret/token assignments. Each rule
+uses regex matching with optional Shannon entropy scoring and keyword
+pre-filtering for performance.
+
+Values that look like placeholders (`{{password}}`, `changeme`, `your_api_key_here`)
+are detected and downgraded rather than competing with real findings.
+
+## What this tool does NOT do
+
+- No git-history scanning (use Gitleaks/TruffleHog for that)
+- No live credential verification
+- No bypassing macOS security prompts
+- Secret detection modules never make outbound network calls

layer8_secretscan-0.1.0/README.md

@@ -0,0 +1,76 @@
+# secretscan
+
+A personal security-hygiene tool: scans your own machine for accidentally
+exposed secrets (API keys, tokens, passwords, private keys), audits what's
+installed and what's exposed (Docker containers, listening ports), and can
+optionally check your local network and internet connectivity.
+
+## Install
+
+```sh
+pip install .
+```
+
+Or for development:
+
+```sh
+pip install -e .
+```
+
+## Usage
+
+```sh
+# default scan: everything except lan/internet, print a table
+secretscan run
+
+# scan a specific directory, filesystem module only
+secretscan run --paths ~/Projects --modules filesystem
+
+# full scan including LAN and internet, all formats
+secretscan run --modules filesystem,shell-history,keychain,process-env,installed-tools,network,docker,lan,internet \
+  --yes-lan --format table,json,html --output-dir ./report
+
+# list all detection rules
+secretscan rules list
+
+# use a custom rules file
+secretscan run --rules-file my-rules.yaml
+```
+
+## Modules
+
+| Module | Default | What it does |
+|---|---|---|
+| `filesystem` | yes | Scans files under `--paths` (default `$HOME`) for secret patterns |
+| `shell-history` | yes | Scans `.zsh_history`, `.bash_history`, and other history files |
+| `keychain` | yes | Audits macOS Keychain metadata (never decrypts values) |
+| `process-env` | yes | Inspects your own running processes' command lines |
+| `installed-tools` | yes | Inventories security/dev tools and packages |
+| `network` | yes | Lists TCP/UDP ports this machine is listening on |
+| `docker` | yes | Lists running containers, checks for exposed Docker API |
+| `lan` | opt-in | Probes other devices on your local network (`--yes-lan`) |
+| `internet` | opt-in | Tests outbound connectivity to public endpoints |
+
+## Output formats
+
+- `table` — colored terminal output (default)
+- `json` — machine-readable `{meta, findings}` document
+- `html` — self-contained HTML report with dark/light theme
+- `csv` — flat CSV of findings
+
+## Detection
+
+14 built-in rules covering AWS, GitHub, GitLab, Slack, Stripe, Google, npm,
+PEM private keys, and generic password/secret/token assignments. Each rule
+uses regex matching with optional Shannon entropy scoring and keyword
+pre-filtering for performance.
+
+Values that look like placeholders (`{{password}}`, `changeme`, `your_api_key_here`)
+are detected and downgraded rather than competing with real findings.
+
+## What this tool does NOT do
+
+- No git-history scanning (use Gitleaks/TruffleHog for that)
+- No live credential verification
+- No bypassing macOS security prompts
+- Secret detection modules never make outbound network calls

layer8_secretscan-0.1.0/pyproject.toml

@@ -0,0 +1,25 @@
+[build-system]
+requires = ["setuptools>=68.0", "wheel"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "layer8-secretscan"
+version = "0.1.0"
+description = "Scan your machine for accidentally exposed secrets — API keys, tokens, passwords, private keys — across filesystem, shell history, keychain, processes, and more."
+readme = "README.md"
+license = "MIT"
+requires-python = ">=3.10"
+dependencies = ["pyyaml>=6.0"]
+
+[project.optional-dependencies]
+chrome = ["websocket-client>=1.6.0", "cryptography>=41.0"]
+all = ["websocket-client>=1.6.0", "cryptography>=41.0"]
+
+[project.scripts]
+secretscan = "secretscan.cli:main"
+
+[tool.setuptools.packages.find]
+where = ["src"]
+
+[tool.setuptools.package-data]
+secretscan = ["rules/*.yaml"]

layer8_secretscan-0.1.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

layer8_secretscan-0.1.0/src/layer8_secretscan.egg-info/PKG-INFO

@@ -0,0 +1,91 @@
+Metadata-Version: 2.4
+Name: layer8-secretscan
+Version: 0.1.0
+Summary: Scan your machine for accidentally exposed secrets — API keys, tokens, passwords, private keys — across filesystem, shell history, keychain, processes, and more.
+License-Expression: MIT
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+Requires-Dist: pyyaml>=6.0
+Provides-Extra: chrome
+Requires-Dist: websocket-client>=1.6.0; extra == "chrome"
+Requires-Dist: cryptography>=41.0; extra == "chrome"
+Provides-Extra: all
+Requires-Dist: websocket-client>=1.6.0; extra == "all"
+Requires-Dist: cryptography>=41.0; extra == "all"
+
+# secretscan
+
+A personal security-hygiene tool: scans your own machine for accidentally
+exposed secrets (API keys, tokens, passwords, private keys), audits what's
+installed and what's exposed (Docker containers, listening ports), and can
+optionally check your local network and internet connectivity.
+
+## Install
+
+```sh
+pip install .
+```
+
+Or for development:
+
+```sh
+pip install -e .
+```
+
+## Usage
+
+```sh
+# default scan: everything except lan/internet, print a table
+secretscan run
+
+# scan a specific directory, filesystem module only
+secretscan run --paths ~/Projects --modules filesystem
+
+# full scan including LAN and internet, all formats
+secretscan run --modules filesystem,shell-history,keychain,process-env,installed-tools,network,docker,lan,internet \
+  --yes-lan --format table,json,html --output-dir ./report
+
+# list all detection rules
+secretscan rules list
+
+# use a custom rules file
+secretscan run --rules-file my-rules.yaml
+```
+
+## Modules
+
+| Module | Default | What it does |
+|---|---|---|
+| `filesystem` | yes | Scans files under `--paths` (default `$HOME`) for secret patterns |
+| `shell-history` | yes | Scans `.zsh_history`, `.bash_history`, and other history files |
+| `keychain` | yes | Audits macOS Keychain metadata (never decrypts values) |
+| `process-env` | yes | Inspects your own running processes' command lines |
+| `installed-tools` | yes | Inventories security/dev tools and packages |
+| `network` | yes | Lists TCP/UDP ports this machine is listening on |
+| `docker` | yes | Lists running containers, checks for exposed Docker API |
+| `lan` | opt-in | Probes other devices on your local network (`--yes-lan`) |
+| `internet` | opt-in | Tests outbound connectivity to public endpoints |
+
+## Output formats
+
+- `table` — colored terminal output (default)
+- `json` — machine-readable `{meta, findings}` document
+- `html` — self-contained HTML report with dark/light theme
+- `csv` — flat CSV of findings
+
+## Detection
+
+14 built-in rules covering AWS, GitHub, GitLab, Slack, Stripe, Google, npm,
+PEM private keys, and generic password/secret/token assignments. Each rule
+uses regex matching with optional Shannon entropy scoring and keyword
+pre-filtering for performance.
+
+Values that look like placeholders (`{{password}}`, `changeme`, `your_api_key_here`)
+are detected and downgraded rather than competing with real findings.
+
+## What this tool does NOT do
+
+- No git-history scanning (use Gitleaks/TruffleHog for that)
+- No live credential verification
+- No bypassing macOS security prompts
+- Secret detection modules never make outbound network calls

layer8_secretscan-0.1.0/src/layer8_secretscan.egg-info/SOURCES.txt

@@ -0,0 +1,38 @@
+README.md
+pyproject.toml
+src/layer8_secretscan.egg-info/PKG-INFO
+src/layer8_secretscan.egg-info/SOURCES.txt
+src/layer8_secretscan.egg-info/dependency_links.txt
+src/layer8_secretscan.egg-info/entry_points.txt
+src/layer8_secretscan.egg-info/requires.txt
+src/layer8_secretscan.egg-info/top_level.txt
+src/secretscan/__init__.py
+src/secretscan/__main__.py
+src/secretscan/cli.py
+src/secretscan/config.py
+src/secretscan/model.py
+src/secretscan/redact.py
+src/secretscan/report/__init__.py
+src/secretscan/report/csv_report.py
+src/secretscan/report/html_report.py
+src/secretscan/report/json_report.py
+src/secretscan/report/table_report.py
+src/secretscan/rules/__init__.py
+src/secretscan/rules/default.yaml
+src/secretscan/rules/entropy.py
+src/secretscan/rules/loader.py
+src/secretscan/rules/placeholder.py
+src/secretscan/rules/rule.py
+src/secretscan/scanner/__init__.py
+src/secretscan/scanner/chrome.py
+src/secretscan/scanner/content.py
+src/secretscan/scanner/docker.py
+src/secretscan/scanner/engine.py
+src/secretscan/scanner/filesystem.py
+src/secretscan/scanner/internet.py
+src/secretscan/scanner/keychain.py
+src/secretscan/scanner/lan.py
+src/secretscan/scanner/network.py
+src/secretscan/scanner/process_env.py
+src/secretscan/scanner/shell_history.py
+src/secretscan/scanner/tools.py

layer8_secretscan-0.1.0/src/layer8_secretscan.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

layer8_secretscan-0.1.0/src/layer8_secretscan.egg-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+secretscan = secretscan.cli:main

layer8_secretscan-0.1.0/src/layer8_secretscan.egg-info/requires.txt

@@ -0,0 +1,9 @@
+pyyaml>=6.0
+
+[all]
+websocket-client>=1.6.0
+cryptography>=41.0
+
+[chrome]
+websocket-client>=1.6.0
+cryptography>=41.0

layer8_secretscan-0.1.0/src/layer8_secretscan.egg-info/top_level.txt

@@ -0,0 +1 @@
+secretscan

layer8_secretscan-0.1.0/src/secretscan/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.1.0"

layer8_secretscan-0.1.0/src/secretscan/__main__.py

@@ -0,0 +1,3 @@
+from secretscan.cli import main
+
+main()

layer8_secretscan-0.1.0/src/secretscan/cli.py

@@ -0,0 +1,243 @@
+from __future__ import annotations
+
+import argparse
+import os
+import sys
+from datetime import datetime
+from pathlib import Path
+
+from secretscan import __version__
+from secretscan.config import Config
+from secretscan.model import Confidence, Module, Severity, DEFAULT_MODULES, OPT_IN_MODULES
+
+
+MODULE_NAMES = {
+    "filesystem": Module.FILESYSTEM,
+    "shell-history": Module.SHELL_HISTORY,
+    "keychain": Module.KEYCHAIN,
+    "process-env": Module.PROCESS_ENV,
+    "installed-tools": Module.INSTALLED_TOOLS,
+    "network": Module.NETWORK,
+    "docker": Module.DOCKER,
+    "chrome": Module.CHROME,
+    "lan": Module.LAN,
+    "internet": Module.INTERNET,
+}
+
+BAR_WIDTH = 30
+
+
+def _progress_bar(done: int, total: int, module_name: str = "") -> None:
+    if total == 0:
+        return
+    pct = int(done / total * 100)
+    filled = int(BAR_WIDTH * done / total)
+    bar = "█" * filled + "░" * (BAR_WIDTH - filled)
+    label = f" {module_name}" if module_name else ""
+    sys.stderr.write(f"\r  [{bar}] {pct:3d}% ({done}/{total}){label}  ")
+    sys.stderr.flush()
+    if done == total:
+        sys.stderr.write("\n")
+
+
+def _render_outputs(cfg: Config, result) -> None:
+    for fmt in cfg.formats:
+        if fmt == "json":
+            from secretscan.report.json_report import render_json
+            if cfg.output_dir:
+                os.makedirs(cfg.output_dir, exist_ok=True)
+                with open(os.path.join(cfg.output_dir, "report.json"), "w") as f:
+                    render_json(f, result.findings, result.meta)
+            else:
+                render_json(sys.stdout, result.findings, result.meta)
+        elif fmt == "html":
+            from secretscan.report.html_report import render_html
+            if cfg.output_dir:
+                os.makedirs(cfg.output_dir, exist_ok=True)
+                with open(os.path.join(cfg.output_dir, "report.html"), "w") as f:
+                    render_html(f, result.findings, result.meta)
+                sys.stderr.write(f"  HTML report written to {cfg.output_dir}/report.html\n")
+            else:
+                render_html(sys.stdout, result.findings, result.meta)
+        elif fmt == "csv":
+            from secretscan.report.csv_report import render_csv
+            if cfg.output_dir:
+                os.makedirs(cfg.output_dir, exist_ok=True)
+                with open(os.path.join(cfg.output_dir, "report.csv"), "w") as f:
+                    render_csv(f, result.findings, result.meta)
+            else:
+                render_csv(sys.stdout, result.findings, result.meta)
+        elif fmt == "table":
+            from secretscan.report.table_report import render_table
+            render_table(sys.stderr, result.findings, result.meta, no_color=False)
+
+
+def _run(args: argparse.Namespace) -> int:
+    from secretscan.scanner.engine import run_scan
+
+    modules: list[Module] = []
+    if args.modules:
+        for name in args.modules.split(","):
+            name = name.strip()
+            try:
+                modules.append(Module(name))
+            except ValueError:
+                sys.stderr.write(f"unknown module: {name}\n")
+                return 2
+    else:
+        modules = list(DEFAULT_MODULES)
+
+    if args.yes_lan and Module.LAN not in modules:
+        modules.append(Module.LAN)
+
+    if Module.LAN in modules and not args.yes_lan:
+        sys.stderr.write(
+            "  The 'lan' module actively probes other devices on your network.\n"
+            "  Pass --yes-lan to confirm you're authorized to scan that network.\n"
+        )
+        modules = [m for m in modules if m != Module.LAN]
+
+    if Module.INTERNET in modules:
+        sys.stderr.write("  The 'internet' module makes real outbound calls to public endpoints.\n")
+
+    paths = args.paths.split(",") if args.paths else [str(Path.home())]
+
+    cfg = Config(
+        paths=paths,
+        modules=modules,
+        exclude_globs=args.exclude.split(",") if args.exclude else [],
+        no_default_excludes=args.no_default_excludes,
+        include_volumes=args.include_volumes,
+        min_severity=Severity(args.min_severity),
+        min_confidence=Confidence(args.min_confidence),
+        rules_file=args.rules_file or "",
+        concurrency=args.concurrency,
+        reveal_length=args.reveal_length,
+        formats=args.format.split(",") if args.format else ["table"],
+        output_dir=args.output_dir or "",
+    )
+
+    module_order = list(cfg.modules)
+
+    def progress(done: int, total: int) -> None:
+        mod_name = module_order[done - 1].value if done <= len(module_order) else ""
+        _progress_bar(done, total, mod_name)
+
+    result = run_scan(cfg, progress=progress)
+    _render_outputs(cfg, result)
+    return 1 if result.findings else 0
+
+
+def _fullscan(args: argparse.Namespace) -> int:
+    from secretscan.scanner.engine import run_scan
+
+    all_modules = list(Module)
+
+    output_dir = args.output_dir
+    if not output_dir:
+        output_dir = str(Path("reports") / datetime.now().strftime("%Y-%m-%d_%H-%M-%S"))
+
+    paths = args.paths.split(",") if args.paths else [str(Path.home())]
+
+    cfg = Config(
+        paths=paths,
+        modules=all_modules,
+        rules_file=args.rules_file or "",
+        concurrency=args.concurrency,
+        reveal_length=args.reveal_length,
+        formats=["html", "json", "table"],
+        output_dir=output_dir,
+    )
+
+    sys.stderr.write(f"\n  secretscan fullscan\n")
+    sys.stderr.write(f"  Paths: {', '.join(paths)}\n")
+    sys.stderr.write(f"  Modules: {', '.join(m.value for m in all_modules)}\n")
+    sys.stderr.write(f"  Output: {output_dir}\n\n")
+
+    module_order = list(cfg.modules)
+
+    def progress(done: int, total: int) -> None:
+        mod_name = module_order[done - 1].value if done <= len(module_order) else ""
+        _progress_bar(done, total, mod_name)
+
+    result = run_scan(cfg, progress=progress)
+    _render_outputs(cfg, result)
+
+    html_path = os.path.join(output_dir, "report.html")
+    if os.path.isfile(html_path):
+        sys.stderr.write(f"\n  Report: {html_path}\n")
+
+    return 1 if result.findings else 0
+
+
+def _rules_list(args: argparse.Namespace) -> int:
+    from secretscan.rules.loader import load_default_rules, load_rules_file
+
+    if args.rules_file:
+        rules = load_rules_file(args.rules_file)
+    else:
+        rules = load_default_rules()
+
+    fmt = "{:<35s} {:<10s} {:<50s}"
+    sys.stdout.write(fmt.format("ID", "SEVERITY", "DESCRIPTION") + "\n")
+    sys.stdout.write("─" * 95 + "\n")
+    for r in rules:
+        sys.stdout.write(
+            fmt.format(r.rule.id, r.rule.severity, r.rule.description[:50]) + "\n"
+        )
+    sys.stdout.write(f"\n{len(rules)} rules loaded.\n")
+    return 0
+
+
+def main(argv: list[str] | None = None) -> None:
+    parser = argparse.ArgumentParser(
+        prog="secretscan",
+        description="Scan your machine for accidentally exposed secrets.",
+    )
+    parser.add_argument("--version", action="version", version=f"secretscan {__version__}")
+    subparsers = parser.add_subparsers(dest="command")
+
+    # --- run ---
+    run_parser = subparsers.add_parser("run", help="Run a scan with selected modules")
+    run_parser.add_argument("--paths", default=None, help="Comma-separated roots to scan (default: $HOME)")
+    run_parser.add_argument("--modules", default=None, help="Comma-separated modules to run")
+    run_parser.add_argument("--exclude", default=None, help="Additional glob patterns to exclude")
+    run_parser.add_argument("--no-default-excludes", action="store_true")
+    run_parser.add_argument("--include-volumes", action="store_true", help="Include /Volumes mounts")
+    run_parser.add_argument("--yes-lan", action="store_true", help="Confirm LAN probing authorization")
+    run_parser.add_argument("--min-severity", default="low", choices=["low", "medium", "high", "critical"])
+    run_parser.add_argument("--min-confidence", default="low", choices=["low", "medium", "high"])
+    run_parser.add_argument("--rules-file", default=None, help="Custom rules YAML file")
+    run_parser.add_argument("--format", default="table", help="Output formats: table,json,html,csv")
+    run_parser.add_argument("--output-dir", default=None, help="Write file reports to this directory")
+    run_parser.add_argument("--reveal-length", action="store_true", help="Show coarse length hint on redacted values")
+    run_parser.add_argument("--concurrency", type=int, default=0, help="Worker threads (default: CPU count)")
+    run_parser.add_argument("--no-color", action="store_true", help="Disable ANSI colors in table output")
+
+    # --- fullscan ---
+    full_parser = subparsers.add_parser("fullscan", help="Run ALL modules (incl. Chrome, LAN, Internet) and generate HTML+JSON reports")
+    full_parser.add_argument("--paths", default=None, help="Comma-separated roots to scan (default: $HOME)")
+    full_parser.add_argument("--output-dir", default=None, help="Write reports here (default: reports/<timestamp>)")
+    full_parser.add_argument("--rules-file", default=None, help="Custom rules YAML file")
+    full_parser.add_argument("--reveal-length", action="store_true")
+    full_parser.add_argument("--concurrency", type=int, default=0)
+
+    # --- rules ---
+    rules_parser = subparsers.add_parser("rules", help="Manage detection rules")
+    rules_sub = rules_parser.add_subparsers(dest="rules_command")
+    list_parser = rules_sub.add_parser("list", help="List all detection rules")
+    list_parser.add_argument("--rules-file", default=None)
+
+    parsed = parser.parse_args(argv)
+
+    if parsed.command == "run":
+        code = _run(parsed)
+    elif parsed.command == "fullscan":
+        code = _fullscan(parsed)
+    elif parsed.command == "rules" and getattr(parsed, "rules_command", None) == "list":
+        code = _rules_list(parsed)
+    else:
+        parser.print_help()
+        code = 0
+
+    sys.exit(code)