configaudit

Config file security scanner. Scans configuration files for common security issues — hardcoded secrets, weak ciphers, dangerous Docker settings, exposed SSH configs, and more. Zero dependencies, pure Python stdlib with regex-based pattern matching.

Features

• Multi-format scanning — .env, Dockerfile, docker-compose.yml, Nginx, Apache, SSH, YAML, JSON, and generic configs
• Severity levels — info, warn, critical with --severity filtering
• Auto-detection — automatically detects config file types, or specify with --type
• Actionable fixes — every issue includes a suggested fix
• Directory recursion — scan entire project trees with --path DIR
• Multiple output formats — text, table, JSON

Install

git clone git@github.com:realMNohgee/configaudit.git
cd configaudit
python3 configaudit.py --path /path/to/configs

Usage

# Scan a single file
python3 configaudit.py --path .env

# Scan a directory recursively
python3 configaudit.py --path ./my-project

# Only show critical issues
python3 configaudit.py --path ./ --severity critical

# JSON output
python3 configaudit.py --path ./configs/ --format json

# Table output
python3 configaudit.py --path ./ --format table

# Force file type detection
python3 configaudit.py --path Dockerfile.prod --type docker

# Strict mode (exit 1 on any issue)
python3 configaudit.py --path ./ --strict

What It Checks

.env Files

• Exposed secrets (API keys, passwords, tokens)
• Empty secret variables
• Missing variables vs .env.example

Docker

• Container running as root
• Hardcoded secrets in ENV
• .env files copied into images
• curl-pipe-bash patterns

Docker Compose

• Privileged mode enabled
• Host network mode
• Hardcoded credentials

Nginx / Apache

• Weak TLS/SSL protocols (SSLv3, TLSv1, TLSv1.1)
• Weak ciphers (RC4, DES, 3DES, MD5)
• Directory listing enabled
• Missing HSTS headers
• HTTP listeners without redirect

SSH Config

• Root login permitted
• Password authentication enabled
• Empty passwords
• Weak ciphers/MACs
• SSH protocol 1

YAML / JSON

• Hardcoded credentials (passwords, API keys, tokens)
• Cloud credentials (AWS keys)
• Database connection strings
• Encryption/signing keys

Generic

• World-readable/writable file permissions
• Hardcoded IP addresses

Example Output

  📄 .env
    🔴 [CRITICAL]  line 3  Exposed secret/key
       Fix: Use environment variable or secrets manager instead of hardcoding
    🟡 [WARN]  line 5  Empty secret variable
       Fix: Populate or remove unused secret variable

  📄 docker-compose.yml
    🔴 [CRITICAL]  line 12  Privileged mode enabled
       Fix: Remove privileged: true — grant only needed capabilities

  3 issue(s) across 2 file(s): 2 critical, 1 warn

Requirements

• Python 3.9+
• No external dependencies (stdlib only)

License

MIT

---

🔗 Find more tools on Hermtica