secably 0.1.0__py3-none-any.whl

secably/__init__.py

@@ -0,0 +1,8 @@
+"""secably — a small command-line toolkit for quick security checks.
+
+Free, local checks (TLS, security headers, DNS/email posture, subdomains) run
+on your machine with no account. Heavier server-side scans use the free Secably
+API. https://secably.com
+"""
+
+__version__ = "0.1.0"

secably/__main__.py

@@ -0,0 +1,4 @@
+from .cli import main
+
+if __name__ == "__main__":
+    raise SystemExit(main())

secably/api.py

@@ -0,0 +1,79 @@
+"""Thin client for Secably's hosted scan API.
+
+Only the heavier, server-side scans (full website vulnerability scan, port
+scan) go through here — the SSL / headers / DNS / subdomain commands run
+entirely on your machine and need no account. A free API key from
+https://secably.com/dashboard/api-keys/ raises the daily limit.
+"""
+from __future__ import annotations
+
+import json
+import os
+import time
+import urllib.request
+import urllib.error
+
+DEFAULT_BASE = os.environ.get("SECABLY_API_URL", "https://secably.com")
+UTM = "utm_source=cli&utm_medium=github&utm_campaign=secably-cli"
+
+
+class SecablyAPIError(RuntimeError):
+    pass
+
+
+class NeedsKey(SecablyAPIError):
+    """Raised when the server rejects the request for missing/exhausted quota."""
+
+
+def _request(method: str, path: str, api_key: str | None, payload: dict | None = None,
+             timeout: float = 30.0) -> dict:
+    url = f"{DEFAULT_BASE}{path}"
+    data = json.dumps(payload).encode() if payload is not None else None
+    headers = {"Content-Type": "application/json", "User-Agent": "secably-cli"}
+    if api_key:
+        headers["X-API-Key"] = api_key
+
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    try:
+        with urllib.request.urlopen(req, timeout=timeout) as resp:
+            return json.loads(resp.read().decode("utf-8", "replace"))
+    except urllib.error.HTTPError as exc:
+        body = exc.read().decode("utf-8", "replace")
+        if exc.code == 429:
+            raise NeedsKey(
+                "Daily scan limit reached. Get a free API key at "
+                f"https://secably.com/dashboard/api-keys/?{UTM} and pass it with "
+                "--api-key or the SECABLY_API_KEY environment variable."
+            )
+        if exc.code in (401, 403):
+            raise NeedsKey(
+                "This scan needs a valid Secably API key. Create one free at "
+                f"https://secably.com/dashboard/api-keys/?{UTM}"
+            )
+        raise SecablyAPIError(f"HTTP {exc.code}: {body[:300]}")
+    except urllib.error.URLError as exc:
+        raise SecablyAPIError(f"Cannot reach Secably API: {exc.reason}")
+
+
+def run_scan(tool: str, target: str, api_key: str | None = None,
+             parameters: dict | None = None, poll_interval: float = 3.0,
+             max_wait: float = 300.0) -> dict:
+    """Create a scan and poll until it finishes. Returns the completed result."""
+    created = _request("POST", "/api/v1/tools/scan/", api_key,
+                       {"tool": tool, "target": target, "parameters": parameters or {}})
+    scan_id = created.get("id")
+    if not scan_id:
+        raise SecablyAPIError(f"Unexpected response: {created}")
+
+    waited = 0.0
+    while waited < max_wait:
+        status = _request("GET", f"/api/v1/tools/scan/{scan_id}/", api_key)
+        state = status.get("status")
+        if state == "completed":
+            return status
+        if state == "failed":
+            raise SecablyAPIError(f"Scan failed: {status.get('error', 'unknown error')}")
+        time.sleep(poll_interval)
+        waited += poll_interval
+
+    raise SecablyAPIError(f"Scan {scan_id} did not finish within {max_wait:.0f}s")

secably/checks/dns.py

@@ -0,0 +1,89 @@
+"""DNS record lookup + email-security posture (SPF / DMARC / DNSSEC).
+
+Uses dnspython when available; otherwise degrades to the standard library for
+the basic record types so the command still works without the optional dep.
+"""
+from __future__ import annotations
+
+try:
+    import dns.resolver
+    import dns.dnssec  # noqa: F401  (import proves DNSSEC support is present)
+    _HAVE_DNSPYTHON = True
+except ImportError:  # pragma: no cover
+    _HAVE_DNSPYTHON = False
+
+_RECORD_TYPES = ["A", "AAAA", "MX", "NS", "TXT", "CNAME", "SOA"]
+
+
+def _query(resolver, name: str, rdtype: str) -> list[str]:
+    try:
+        answers = resolver.resolve(name, rdtype)
+        return [r.to_text() for r in answers]
+    except Exception:  # noqa: BLE001 - NXDOMAIN/NoAnswer/timeout all mean "nothing"
+        return []
+
+
+def check_dns(domain: str, timeout: float = 10.0) -> dict:
+    domain = domain.strip().rstrip(".").replace("https://", "").replace("http://", "").split("/")[0]
+
+    if not _HAVE_DNSPYTHON:
+        return _fallback(domain)
+
+    resolver = dns.resolver.Resolver()
+    resolver.lifetime = timeout
+    resolver.timeout = timeout
+
+    records = {rt: _query(resolver, domain, rt) for rt in _RECORD_TYPES}
+
+    txt = records.get("TXT", [])
+    spf = [t for t in txt if "v=spf1" in t.lower()]
+    dmarc = _query(resolver, f"_dmarc.{domain}", "TXT")
+    dmarc = [t for t in dmarc if "v=dmarc1" in t.lower()]
+
+    # DNSSEC: presence of a DNSKEY at the zone apex.
+    dnssec = bool(_query(resolver, domain, "DNSKEY"))
+
+    warnings = []
+    if not spf:
+        warnings.append("No SPF record — sender spoofing is easier without one.")
+    if not dmarc:
+        warnings.append("No DMARC record — no policy for handling spoofed mail.")
+    if not dnssec:
+        warnings.append("DNSSEC not enabled — responses are not cryptographically signed.")
+
+    return {
+        "domain": domain,
+        "records": records,
+        "spf": spf,
+        "dmarc": dmarc,
+        "dnssec": dnssec,
+        "warnings": warnings,
+        "engine": "dnspython",
+    }
+
+
+def _fallback(domain: str) -> dict:
+    """Minimal A/AAAA lookup via the stdlib when dnspython is missing."""
+    import socket
+
+    a, aaaa = [], []
+    try:
+        for info in socket.getaddrinfo(domain, None):
+            family, addr = info[0], info[4][0]
+            if family == socket.AF_INET:
+                a.append(addr)
+            elif family == socket.AF_INET6:
+                aaaa.append(addr)
+    except socket.gaierror:
+        pass
+
+    return {
+        "domain": domain,
+        "records": {"A": sorted(set(a)), "AAAA": sorted(set(aaaa))},
+        "spf": [],
+        "dmarc": [],
+        "dnssec": False,
+        "warnings": ["Install 'dnspython' for MX/TXT/SPF/DMARC/DNSSEC checks "
+                     "(pip install secably[dns])."],
+        "engine": "stdlib",
+    }

secably/checks/headers.py

@@ -0,0 +1,79 @@
+"""HTTP security-header grading — mirrors the logic behind Secably's HTTP Headers tool."""
+from __future__ import annotations
+
+import urllib.request
+import urllib.error
+import ssl
+
+# (header, weight, short advice) — weights sum to 100.
+_SCORED = [
+    ("strict-transport-security", 25, "Add HSTS to force HTTPS and prevent downgrade attacks."),
+    ("content-security-policy", 25, "Add a Content-Security-Policy to mitigate XSS and injection."),
+    ("x-frame-options", 15, "Set X-Frame-Options (or CSP frame-ancestors) to block clickjacking."),
+    ("x-content-type-options", 15, "Set X-Content-Type-Options: nosniff."),
+    ("referrer-policy", 10, "Set a Referrer-Policy to limit referrer leakage."),
+    ("permissions-policy", 10, "Set a Permissions-Policy to restrict powerful browser features."),
+]
+
+# Headers that leak stack details — flagged but not scored against the grade.
+_LEAKY = ["server", "x-powered-by", "x-aspnet-version", "x-generator"]
+
+
+def _grade(score: int) -> str:
+    if score >= 90:
+        return "A"
+    if score >= 75:
+        return "B"
+    if score >= 60:
+        return "C"
+    if score >= 40:
+        return "D"
+    if score >= 20:
+        return "E"
+    return "F"
+
+
+def check_headers(url: str, timeout: float = 10.0) -> dict:
+    if not url.startswith(("http://", "https://")):
+        url = "https://" + url
+
+    ctx = ssl.create_default_context()
+    ctx.check_hostname = False
+    ctx.verify_mode = ssl.CERT_NONE
+
+    req = urllib.request.Request(
+        url,
+        method="GET",
+        headers={"User-Agent": "secably-cli (+https://secably.com)"},
+    )
+    try:
+        resp = urllib.request.urlopen(req, timeout=timeout, context=ctx)
+        status = resp.status
+        raw = {k.lower(): v for k, v in resp.headers.items()}
+        final_url = resp.geturl()
+    except urllib.error.HTTPError as exc:
+        # Still inspect headers on 4xx/5xx responses.
+        status = exc.code
+        raw = {k.lower(): v for k, v in exc.headers.items()}
+        final_url = url
+
+    present, missing = [], []
+    score = 0
+    for name, weight, advice in _SCORED:
+        if name in raw:
+            score += weight
+            present.append({"header": name, "value": raw[name]})
+        else:
+            missing.append({"header": name, "advice": advice})
+
+    leaks = [{"header": h, "value": raw[h]} for h in _LEAKY if h in raw]
+
+    return {
+        "url": final_url,
+        "status": status,
+        "score": score,
+        "grade": _grade(score),
+        "present": present,
+        "missing": missing,
+        "info_leaks": leaks,
+    }

secably/checks/subdomains.py

@@ -0,0 +1,53 @@
+"""Subdomain enumeration via Certificate Transparency logs (crt.sh).
+
+This is the same passive technique behind Secably's Subdomain Finder: query
+public CT logs, which record every TLS certificate issued for a domain, then
+deduplicate the names. No brute force, no traffic to the target.
+"""
+from __future__ import annotations
+
+import json
+import socket
+import urllib.parse
+import urllib.request
+
+_CRT_SH = "https://crt.sh/?q=%25.{domain}&output=json"
+
+
+def _fetch_crtsh(domain: str, timeout: float) -> list[str]:
+    url = _CRT_SH.format(domain=urllib.parse.quote(domain))
+    req = urllib.request.Request(url, headers={"User-Agent": "secably-cli (+https://secably.com)"})
+    with urllib.request.urlopen(req, timeout=timeout) as resp:
+        data = json.loads(resp.read().decode("utf-8", "replace"))
+
+    names: set[str] = set()
+    for row in data:
+        for field in ("name_value", "common_name"):
+            value = row.get(field, "")
+            for name in value.split("\n"):
+                name = name.strip().lower().lstrip("*.")
+                if name.endswith(domain) and name != domain:
+                    names.add(name)
+    return sorted(names)
+
+
+def check_subdomains(domain: str, resolve: bool = False, timeout: float = 30.0) -> dict:
+    domain = domain.strip().rstrip(".").lower().replace("https://", "").replace("http://", "").split("/")[0]
+
+    found = _fetch_crtsh(domain, timeout)
+
+    resolved = {}
+    if resolve:
+        for name in found:
+            try:
+                resolved[name] = socket.gethostbyname(name)
+            except socket.gaierror:
+                resolved[name] = None
+
+    return {
+        "domain": domain,
+        "count": len(found),
+        "subdomains": found,
+        "resolved": resolved,
+        "source": "crt.sh (Certificate Transparency)",
+    }

secably/checks/tls.py

@@ -0,0 +1,129 @@
+"""TLS/SSL certificate inspection — pure standard library, no network service needed."""
+from __future__ import annotations
+
+import os
+import socket
+import ssl
+import tempfile
+from datetime import datetime, timezone
+
+# Protocols considered obsolete/insecure if the server still negotiates them.
+_WEAK_PROTOCOLS = {"SSLv2", "SSLv3", "TLSv1", "TLSv1.1"}
+
+
+_MONTHS = {m: i for i, m in enumerate(
+    ["Jan", "Feb", "Mar", "Apr", "May", "Jun",
+     "Jul", "Aug", "Sep", "Oct", "Nov", "Dec"], start=1)}
+
+
+def _parse_cert_time(value: str) -> datetime:
+    # OpenSSL format: 'Jun  1 12:00:00 2026 GMT' — always English month names
+    # regardless of system locale, so parse the fields by hand rather than via
+    # strptime('%b'), which is locale-dependent and breaks on non-English hosts.
+    parts = value.split()  # ['Jun', '1', '12:00:00', '2026', 'GMT']
+    if len(parts) < 4:
+        raise ValueError(f"Unrecognized certificate time: {value!r}")
+    month = _MONTHS[parts[0][:3]]
+    day = int(parts[1])
+    hour, minute, second = (int(x) for x in parts[2].split(":"))
+    year = int(parts[3])
+    return datetime(year, month, day, hour, minute, second, tzinfo=timezone.utc)
+
+
+def _flatten_name(rdn_sequence) -> dict:
+    out = {}
+    for rdn in rdn_sequence:
+        for key, val in rdn:
+            out[key] = val
+    return out
+
+
+def _decode_der(der: bytes) -> dict:
+    """Decode a DER certificate into the same dict shape as getpeercert().
+
+    Needed because getpeercert() returns {} under CERT_NONE, but we still want
+    to inspect expired/self-signed certs. Uses the stdlib's own decoder.
+    """
+    pem = ssl.DER_cert_to_PEM_cert(der)
+    tmp = tempfile.NamedTemporaryFile("w", suffix=".pem", delete=False)
+    try:
+        tmp.write(pem)
+        tmp.close()
+        return ssl._ssl._test_decode_cert(tmp.name)  # noqa: SLF001 - stable stdlib helper
+    finally:
+        os.unlink(tmp.name)
+
+
+def check_tls(host: str, port: int = 443, timeout: float = 10.0) -> dict:
+    """Connect, complete the TLS handshake and describe the certificate + protocol.
+
+    Returns a dict with cert subject/issuer, validity window, days_left, the
+    negotiated protocol/cipher, and a list of human-readable warnings.
+    """
+    host = host.strip().replace("https://", "").replace("http://", "").split("/")[0]
+    if ":" in host:
+        host, _, maybe_port = host.partition(":")
+        if maybe_port.isdigit():
+            port = int(maybe_port)
+
+    ctx = ssl.create_default_context()
+    ctx.check_hostname = False
+    ctx.verify_mode = ssl.CERT_NONE  # we inspect, we don't reject
+
+    warnings: list[str] = []
+    with socket.create_connection((host, port), timeout=timeout) as sock:
+        with ctx.wrap_socket(sock, server_hostname=host) as tls:
+            der = tls.getpeercert(binary_form=True)
+            protocol = tls.version()
+            cipher = tls.cipher()
+    cert = _decode_der(der) if der else {}
+
+    # A verifying context is also tried so we can report trust separately.
+    trusted = True
+    trust_error = None
+    try:
+        vctx = ssl.create_default_context()
+        with socket.create_connection((host, port), timeout=timeout) as sock:
+            with vctx.wrap_socket(sock, server_hostname=host):
+                pass
+    except ssl.SSLCertVerificationError as exc:
+        trusted = False
+        trust_error = exc.verify_message or str(exc)
+    except Exception:  # noqa: BLE001 - hostname mismatch etc. still means "not trusted as-is"
+        trusted = False
+
+    subject = _flatten_name(cert.get("subject", []))
+    issuer = _flatten_name(cert.get("issuer", []))
+    not_after = _parse_cert_time(cert["notAfter"])
+    not_before = _parse_cert_time(cert["notBefore"])
+    now = datetime.now(timezone.utc)
+    days_left = (not_after - now).days
+
+    sans = [v for k, v in cert.get("subjectAltName", []) if k == "DNS"]
+
+    if days_left < 0:
+        warnings.append(f"Certificate EXPIRED {abs(days_left)} day(s) ago")
+    elif days_left <= 14:
+        warnings.append(f"Certificate expires in {days_left} day(s)")
+    if now < not_before:
+        warnings.append("Certificate is not valid yet (notBefore in the future)")
+    if protocol in _WEAK_PROTOCOLS:
+        warnings.append(f"Server negotiated obsolete protocol {protocol}")
+    if not trusted:
+        warnings.append("Certificate chain does not verify against system trust store"
+                        + (f" ({trust_error})" if trust_error else ""))
+
+    return {
+        "host": host,
+        "port": port,
+        "subject_cn": subject.get("commonName"),
+        "issuer_cn": issuer.get("commonName") or issuer.get("organizationName"),
+        "not_before": not_before.isoformat(),
+        "not_after": not_after.isoformat(),
+        "days_left": days_left,
+        "protocol": protocol,
+        "cipher": cipher[0] if cipher else None,
+        "san": sans,
+        "trusted": trusted,
+        "warnings": warnings,
+    }

secably/cli.py

@@ -0,0 +1,200 @@
+"""Command-line entry point for secably."""
+from __future__ import annotations
+
+import argparse
+import os
+import sys
+
+from . import __version__
+from . import output as out
+
+
+def _add_common(p: argparse.ArgumentParser) -> None:
+    p.add_argument("--json", action="store_true", help="Emit machine-readable JSON.")
+    p.add_argument("--timeout", type=float, default=None, help="Network timeout in seconds.")
+    p.add_argument("--no-upsell", action="store_true", help=argparse.SUPPRESS)
+
+
+def build_parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser(
+        prog="secably",
+        description="Quick security checks from your terminal. "
+                    "TLS, headers, DNS and subdomains run locally; port and "
+                    "website scans use the free Secably API.",
+        epilog="Docs & source: https://github.com/secably/secably-cli",
+    )
+    parser.add_argument("--version", action="version", version=f"secably {__version__}")
+    sub = parser.add_subparsers(dest="command", required=True)
+
+    p = sub.add_parser("ssl", help="Inspect a host's TLS certificate and protocol.")
+    p.add_argument("host")
+    p.add_argument("--port", type=int, default=443)
+    p.add_argument("--fail-if-expires", type=int, metavar="DAYS",
+                   help="Exit non-zero if the cert expires within DAYS (for CI).")
+    _add_common(p)
+
+    p = sub.add_parser("headers", help="Grade a site's HTTP security headers (A-F).")
+    p.add_argument("url")
+    p.add_argument("--fail-below", metavar="GRADE",
+                   help="Exit non-zero if the grade is below GRADE, e.g. B (for CI).")
+    _add_common(p)
+
+    p = sub.add_parser("dns", help="Look up DNS records + SPF/DMARC/DNSSEC posture.")
+    p.add_argument("domain")
+    _add_common(p)
+
+    p = sub.add_parser("subdomains", help="Enumerate subdomains via Certificate Transparency.")
+    p.add_argument("domain")
+    p.add_argument("--resolve", action="store_true", help="Resolve each subdomain to an IP.")
+    _add_common(p)
+
+    p = sub.add_parser("scan", help="Run a hosted port or website scan (Secably API).")
+    p.add_argument("target")
+    p.add_argument("--type", choices=["website", "port"], default="website",
+                   help="Scan type (default: website).")
+    p.add_argument("--api-key", help="Secably API key (or set SECABLY_API_KEY).")
+    _add_common(p)
+
+    return parser
+
+
+# ---- command handlers -------------------------------------------------------
+
+def _cmd_ssl(args) -> int:
+    from .checks.tls import check_tls
+    res = check_tls(args.host, port=args.port, timeout=args.timeout or 10.0)
+    if args.json:
+        out.emit_json(res)
+    else:
+        out.heading(f"TLS — {res['host']}:{res['port']}")
+        out.kv("Subject", res["subject_cn"])
+        out.kv("Issuer", res["issuer_cn"])
+        out.kv("Valid until", f"{res['not_after']}  ({res['days_left']} days left)")
+        out.kv("Protocol", res["protocol"])
+        out.kv("Cipher", res["cipher"])
+        out.kv("Trusted", "yes" if res["trusted"] else "no")
+        if res["san"]:
+            out.kv("SAN", ", ".join(res["san"][:8]) + (" …" if len(res["san"]) > 8 else ""))
+        for w in res["warnings"]:
+            out.bullet(w, marker="!")
+    rc = 0
+    if args.fail_if_expires is not None and res["days_left"] < args.fail_if_expires:
+        print(f"\nFAIL: certificate expires in {res['days_left']} day(s) "
+              f"(threshold {args.fail_if_expires}).", file=sys.stderr)
+        rc = 2
+    if not args.no_upsell and not args.json:
+        out.footer()
+    return rc
+
+
+def _cmd_headers(args) -> int:
+    from .checks.headers import check_headers
+    res = check_headers(args.url, timeout=args.timeout or 10.0)
+    if args.json:
+        out.emit_json(res)
+    else:
+        out.heading(f"Security headers — {res['url']}")
+        print(f"  Grade: {out.color_grade(res['grade'])}  ({res['score']}/100, HTTP {res['status']})")
+        if res["present"]:
+            print("  Present:")
+            for h in res["present"]:
+                out.bullet(h["header"])
+        if res["missing"]:
+            print("  Missing:")
+            for h in res["missing"]:
+                out.bullet(f"{h['header']} — {h['advice']}", marker="✗")
+        if res["info_leaks"]:
+            print("  Info leaks:")
+            for h in res["info_leaks"]:
+                out.bullet(f"{h['header']}: {h['value']}", marker="!")
+    rc = 0
+    order = "FEDCBA"
+    if args.fail_below and res["grade"] in order and args.fail_below.upper() in order:
+        if order.index(res["grade"]) < order.index(args.fail_below.upper()):
+            print(f"\nFAIL: grade {res['grade']} is below {args.fail_below.upper()}.",
+                  file=sys.stderr)
+            rc = 2
+    if not args.no_upsell and not args.json:
+        out.footer()
+    return rc
+
+
+def _cmd_dns(args) -> int:
+    from .checks.dns import check_dns
+    res = check_dns(args.domain, timeout=args.timeout or 10.0)
+    if args.json:
+        out.emit_json(res)
+    else:
+        out.heading(f"DNS — {res['domain']}")
+        for rtype, values in res["records"].items():
+            if values:
+                out.kv(rtype, values[0] if len(values) == 1 else f"{len(values)} records")
+                for extra in values[1:]:
+                    print(f"  {'':<16} {extra}")
+        out.kv("SPF", res["spf"][0] if res["spf"] else "—")
+        out.kv("DMARC", res["dmarc"][0] if res["dmarc"] else "—")
+        out.kv("DNSSEC", "enabled" if res["dnssec"] else "—")
+        for w in res["warnings"]:
+            out.bullet(w, marker="!")
+    if not args.no_upsell and not args.json:
+        out.footer()
+    return 0
+
+
+def _cmd_subdomains(args) -> int:
+    from .checks.subdomains import check_subdomains
+    res = check_subdomains(args.domain, resolve=args.resolve, timeout=args.timeout or 30.0)
+    if args.json:
+        out.emit_json(res)
+    else:
+        out.heading(f"Subdomains — {res['domain']}  ({res['count']} found)")
+        print(f"  {out.dim(res['source'])}")
+        for name in res["subdomains"]:
+            if args.resolve:
+                ip = res["resolved"].get(name)
+                out.bullet(f"{name:<40} {ip or '(no A record)'}")
+            else:
+                out.bullet(name)
+    if not args.no_upsell and not args.json:
+        out.footer()
+    return 0
+
+
+def _cmd_scan(args) -> int:
+    from .api import run_scan, SecablyAPIError, NeedsKey
+    tool = "website_scanner" if args.type == "website" else "port_scanner"
+    api_key = args.api_key or os.environ.get("SECABLY_API_KEY")
+    try:
+        res = run_scan(tool, args.target, api_key=api_key)
+    except NeedsKey as exc:
+        print(str(exc), file=sys.stderr)
+        return 3
+    except SecablyAPIError as exc:
+        print(f"Error: {exc}", file=sys.stderr)
+        return 1
+    if args.json:
+        out.emit_json(res)
+    else:
+        out.heading(f"{args.type.title()} scan — {args.target}")
+        out.emit_json(res.get("result", res))
+    return 0
+
+
+_HANDLERS = {
+    "ssl": _cmd_ssl,
+    "headers": _cmd_headers,
+    "dns": _cmd_dns,
+    "subdomains": _cmd_subdomains,
+    "scan": _cmd_scan,
+}
+
+
+def main(argv=None) -> int:
+    args = build_parser().parse_args(argv)
+    try:
+        return _HANDLERS[args.command](args)
+    except KeyboardInterrupt:
+        return 130
+    except (OSError, ValueError) as exc:
+        print(f"Error: {exc}", file=sys.stderr)
+        return 1

secably/output.py

@@ -0,0 +1,51 @@
+"""Terminal formatting helpers — plain, dependency-free, and CI-friendly."""
+from __future__ import annotations
+
+import json
+import sys
+
+UPSELL = (
+    "secably.com — free online security tools + continuous domain monitoring. "
+    "Port & full website vulnerability scans and always-on alerts: "
+    "https://secably.com/?utm_source=cli&utm_medium=github&utm_campaign=secably-cli"
+)
+
+_COLORS = {"A": "92", "B": "92", "C": "93", "D": "93", "E": "91", "F": "91"}
+
+
+def _tty() -> bool:
+    return sys.stdout.isatty()
+
+
+def dim(text: str) -> str:
+    return f"\033[2m{text}\033[0m" if _tty() else text
+
+
+def color_grade(grade: str) -> str:
+    if not _tty():
+        return grade
+    code = _COLORS.get(grade, "0")
+    return f"\033[1;{code}m{grade}\033[0m"
+
+
+def emit_json(data: dict) -> None:
+    json.dump(data, sys.stdout, indent=2, default=str)
+    sys.stdout.write("\n")
+
+
+def heading(text: str) -> None:
+    print(f"\n{text}")
+    print("-" * len(text))
+
+
+def kv(key: str, value) -> None:
+    print(f"  {key:<16} {value}")
+
+
+def bullet(text: str, marker: str = "•") -> None:
+    print(f"  {marker} {text}")
+
+
+def footer() -> None:
+    print()
+    print(dim(UPSELL))

secably-0.1.0.dist-info/METADATA

@@ -0,0 +1,94 @@
+Metadata-Version: 2.4
+Name: secably
+Version: 0.1.0
+Summary: Command-line security checks: TLS, HTTP security headers, DNS/email posture and subdomain discovery — run locally, no account needed.
+Author-email: Secably <hello@secably.com>
+License: MIT
+Project-URL: Homepage, https://secably.com
+Project-URL: Source, https://github.com/secably/secably-cli
+Project-URL: Issues, https://github.com/secably/secably-cli/issues
+Keywords: security,tls,ssl,http-headers,dns,subdomain,recon,devsecops,cli
+Classifier: Development Status :: 4 - Beta
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: Intended Audience :: System Administrators
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Security
+Classifier: Topic :: Internet :: WWW/HTTP :: Site Management
+Classifier: Topic :: System :: Networking :: Monitoring
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Provides-Extra: dns
+Requires-Dist: dnspython>=2.0; extra == "dns"
+Provides-Extra: all
+Requires-Dist: dnspython>=2.0; extra == "all"
+Dynamic: license-file
+
+# secably
+
+Quick security checks from your terminal — TLS certificates, HTTP security
+headers, DNS/email posture, and subdomain discovery. The everyday checks run
+**locally on your machine, with no account and no rate limit**. Heavier scans
+(full website vulnerability scan, port scan) use the free
+[Secably](https://secably.com) API.
+
+```
+pip install secably          # core checks (zero dependencies)
+pip install "secably[dns]"   # adds MX/TXT/SPF/DMARC/DNSSEC via dnspython
+```
+
+## Usage
+
+```bash
+# TLS certificate + negotiated protocol, with a CI-friendly expiry gate
+secably ssl example.com
+secably ssl example.com --fail-if-expires 14
+
+# Grade the HTTP security headers A–F (fail a build below B)
+secably headers https://example.com
+secably headers example.com --fail-below B
+
+# DNS records + email spoofing posture (SPF / DMARC / DNSSEC)
+secably dns example.com
+
+# Passive subdomain discovery via Certificate Transparency (crt.sh)
+secably subdomains example.com --resolve
+
+# Hosted port / website vulnerability scan (needs a free API key)
+secably scan example.com --type website
+```
+
+Add `--json` to any command for machine-readable output — handy in pipelines.
+
+## Local vs. hosted
+
+| Command | Where it runs | Account needed |
+|---|---|---|
+| `ssl`, `headers`, `dns`, `subdomains` | your machine | no |
+| `scan` (website / port) | Secably API | free API key |
+
+The local commands never touch Secably's servers, so there's no quota to hit.
+The `scan` command runs deeper, server-side checks; create a free key at
+**https://secably.com/dashboard/api-keys/** and pass it via `--api-key` or the
+`SECABLY_API_KEY` environment variable. Free keys include a daily allowance;
+paid plans lift it.
+
+## Use in CI
+
+Both `ssl --fail-if-expires` and `headers --fail-below` exit non-zero on
+failure, so they drop straight into a pipeline:
+
+```yaml
+- run: pipx run secably ssl your-domain.com --fail-if-expires 21
+- run: pipx run secably headers https://your-domain.com --fail-below B
+```
+
+For always-on monitoring of certificate expiry, new subdomains and open ports
+between deploys, Secably runs the same checks continuously and alerts you:
+<https://secably.com/?utm_source=cli&utm_medium=github&utm_campaign=secably-cli>
+
+## License
+
+MIT — see [LICENSE](LICENSE).

secably-0.1.0.dist-info/RECORD

@@ -0,0 +1,15 @@
+secably/__init__.py,sha256=dhTtm1-vm8a04nupFnkKMVPN4Jh6-Z37mA0h5nT4Bi0,282
+secably/__main__.py,sha256=MHKZ_ae3fSLGTLUUMOx15fWdeOnJSHhq-zslRP5F5Lc,79
+secably/api.py,sha256=ajzQoQe8Mvntpojkj4G0fgVs5Jw5GZikR52YgaFUHFs,3165
+secably/cli.py,sha256=_GDAQhDC1mXSG7OHg7pDRpTPuDC3Ci6PowkRL_9tPto,7424
+secably/output.py,sha256=YqhFWEjJwEyoCIry67Z7DqLKoTwk2fZ4bl0SqVj9Bmg,1176
+secably/checks/dns.py,sha256=q1thV4eeRVLVHQBWtsNirVXDCu6v1NHZ-SPd-NhiJ20,2843
+secably/checks/headers.py,sha256=YY7zZtyg0QCRee3AGerSrmtgDoJn_-duPbx_YjGoQXk,2582
+secably/checks/subdomains.py,sha256=wfeOpG5edDyihEBLAzlHN04Cdd0Vt6sGotngwsUe7-o,1811
+secably/checks/tls.py,sha256=BsD8sxyEgT4lZmBiffiwXGw6XDlu9JGElh3ebg8370Q,4920
+secably-0.1.0.dist-info/licenses/LICENSE,sha256=MBwhq1iAKIxrs_xsCXdfRjPa6hsN7IVMUCB_PqxLdKk,1064
+secably-0.1.0.dist-info/METADATA,sha256=y9XilIYiw6RQr9X3Ya5XTrCtUoOPE3hSFec5r_2WgbI,3426
+secably-0.1.0.dist-info/WHEEL,sha256=K260EYznzXsJYBQGqmI8VTxEdiZYNvDZwW9cBh9-_MA,91
+secably-0.1.0.dist-info/entry_points.txt,sha256=X1dxct9UnRdXEz2bRGZw3ZtQsVIsdjeO717vLP69Teg,45
+secably-0.1.0.dist-info/top_level.txt,sha256=HwH4lyDAOlAfkIolRjx7_no02Rd_gskrJ6bB6w1Bwi4,8
+secably-0.1.0.dist-info/RECORD,,

secably-0.1.0.dist-info/WHEEL

@@ -0,0 +1,5 @@
+Wheel-Version: 1.0
+Generator: setuptools (83.0.0)
+Root-Is-Purelib: true
+Tag: py3-none-any
+

secably-0.1.0.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+secably = secably.cli:main

secably-0.1.0.dist-info/licenses/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Secably
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

secably-0.1.0.dist-info/top_level.txt

@@ -0,0 +1 @@
+secably