v0.1.0-alpha.1

Airgap Guardian v0.1.0-alpha

First public alpha of Airgap Guardian, an offline-first security scanner for air-gapped and restricted environments. One Rust binary, no network at runtime.

What It Does

Scan local filesystems for common security issues across four asset types:

• Certificates — expiration, weak RSA keys, disallowed signature algorithms, self-signed certs, missing SAN, long validity
• SSH — private key strength and encryption, weak authorized_keys algorithms, duplicate keys
• Secrets — AWS keys, GitHub tokens, PEM private key material, generic API keys
• JWT — structure and claims (alg, exp, iss, aud); flags alg=none, expired, and long-lived tokens

Every asset gets a risk score (0–100). Thresholds are driven by a TOML policy engine.

Commands

• scan — audit a directory or inventory file
• discover — find likely asset locations, write inventory.toml
• inventory — catalog every discovered asset
  Output formats: terminal table, JSON, or standalone offline HTML report.

Install

cargo install --path .
# or
cargo build --release

Container

cargo vendor vendor
podman build --network=none -t airgap-guardian .
podman run --rm airgap-guardian

Quick Start

airgap-guardian scan ./testdata
airgap-guardian discover /etc --output inventory.toml
airgap-guardian scan -i inventory.toml --json --html report.html

Alpha status

This is an early release for feedback and evaluation. Expect:

• API and CLI flags to stabilize but may change before 1.0
• Heuristic secret/JWT detection — false positives and misses are possible
• JWT analysis is structural only; signatures are not verified

Bug reports and use-case feedback are welcome.

License

MIT