Scout v0.3.0 (pre-release)

Adds source-tree analysis collectors. Scout now ships nine collectors (35 checks).

New in v0.3.0

• secrets (code.secrets) — scans a repo (--repo) for committed credentials: AWS/Google/Slack/GitHub/Stripe keys, private-key blocks, JWTs, and hard-coded password/secret assignments. Values are masked and redacted in evidence. Weak generic hits in test files and docs are downgraded so fixtures don't skew the grade; strong key patterns stay high everywhere.
• dockerfile (code.dockerfile) — lints Dockerfiles for running as root (or no USER), unpinned base images, remote ADD, and secrets baked into ENV/ARG.

Both read files only — no network, no container build.

Also

• Fixed the DNS collector erroring on localhost / single-label hosts.
• Fixed the TLS collector's deliberate weak-protocol probes tripping gosec.

Verified

Against a real repo, the secrets collector surfaced hard-coded secrets in a DB seeder and a shared constants package (while correctly downgrading test fixtures).

Still to come (why this is v0.3, not v1.0)

Active DAST input testing (SQLi/XSS/SSRF), authentication/access control (JWT, IDOR, CORS), Nuclei templates, dependency-CVE/SAST/container scanning, and a host agent are not bundled. Scout covers the HTTP surface, exposed services and source analysis — not the full OWASP Top 10.

Install

go install github.com/MUKE-coder/scout/cmd/scout@v0.3.0