ittcsecscan

ittcsecscan finds real security problems in your cloud, connects them into attack paths, ranks what matters, and explains how to fix each one. It runs on your own machine, reads only, and keeps everything it collects local.

• Finds real problems, like storage open to the public, databases reachable from the internet, and encryption keys without rotation.
• Connects the dots: it shows attack paths, how one weakness plus an identity can reach something sensitive, not just a flat list of issues.
• Ranks what matters so you fix the most dangerous things first.
• Explains the fix for each finding, with exact steps, and never changes your cloud on its own.
• Is honest: if it could not check something (for example, access was denied), it says so. It never guesses, and never reports a guess as a fact.
• Keeps your data local: everything it collects is stored, encrypted, on your machine. Your scan results never leave your machine.

ittcsecscan scans AWS, Microsoft Azure, and Google Cloud. It uses your cloud's own login (the same one the official CLI uses) and only ever reads. It never asks for or stores your cloud password, and it performs no write, change, or delete in a normal scan. Read-only, least-privilege permission lists are published per provider in the project's permission matrix.

Alongside the core exposure checks (public storage, public databases, internet-exposed compute, missing key rotation, and Key Vault without purge protection), it checks:

• Identity hygiene: AWS users and the root account without MFA, access keys that are unused or never rotated, an active root access key, dormant roles, Azure application credentials that are expired or valid for too long, high-impact Microsoft Graph permissions granted to an app, and Google Cloud service-account keys that are too old.
• AI Guard: risky AI agent setups, an agent with excessive privileges, an unsafe tool, or access to dangerous data.

Each check applies to the cloud it is written for. A rule for a cloud you did not scan is reported as not applicable, never as a pass, so the report never implies something was checked when it was not.

Download the one file that matches your computer from the project's Releases page:

You do not need to install anything else or build the tool yourself.

Each release is signed. Put the file you downloaded, plus SHA256SUMS and SHA256SUMS.sig from the same release, in one folder. From a clone of this repository (OpenSSH 8.1 or later; Git Bash on Windows), run:

release/verify.sh --partial FOLDER

It checks the signature against the trust root in the repository, then checks every file you downloaded against SHA256SUMS. If it does not print success, do not run the binary.

1. Create your local key (one time). It encrypts everything stored on your machine:

./ittcsecscan keys init

2. Scan and write the report. This creates a new local record for a cloud you are logged in to, scans it, and writes the report next to the binary in every format (HTML, JSON, SARIF, PDF, and Word):

./ittcsecscan scan --create --report-dir ./ittcsecscan-report

It prints a tenant id and stores an encrypted record on your machine. Open the HTML file in your browser: every report starts with what was and was not checked, then lists findings worst first, each with why it matters and how to fix it. Use that tenant id with other commands (for example fix to see remediation steps, or classify to mark business-critical assets) to work with the same record again.

• This is a release candidate. Interfaces and output may still change before 1.0.0.
• Remediation is plan-only. The fix command prints exact, documented remediation steps and verification guidance. It never changes your cloud. You apply changes yourself.
• Rules for a cloud you did not scan report "not applicable". If you scan only AWS, the Azure and Google Cloud rules are reported as not applicable rather than as passes.
• Honest gaps. When access is denied, a service is unavailable, or data cannot be fully read, the result is reported as a gap or as unknown, never as a pass.
• One optional network call. The only network use beyond reading your cloud's APIs is an optional update check, off unless you pass its --repo and --root options; it fetches public release metadata over HTTPS with an anonymous request and sends no scan data, credentials, or inventory.

Please do not open a public issue for a security problem. Report it privately through the project's security policy (SECURITY.md), which lists the contact address and what to include. Use synthetic or test-tenant data only in any report.

Apache-2.0. See LICENSE.