DevSecOps Utility Toolkit

A suite of Node.js-based command-line security auditing tools designed to help developers identify vulnerabilities, hardcoded secrets, misconfigurations, and weak TLS setups before code goes to production.

---

🛠️ Tools Included

1. Secrets Scanner (secrets-scanner.js)

Scans directories recursively to detect high-entropy strings, credential structures, private keys, and API tokens.

• Checks performed:
  • AWS Access/Secret Key signatures
  • Slack Webhook URLs
  • Private Keys (RSA, PEM, SSH)
  • Generic high-entropy strings (looks like JWTs or database passwords)
  • Database connection strings (MongoDB, PostgreSQL)
• Usage:

  node secrets-scanner.js <path-to-directory-or-file>

2. Dockerfile Security Linter (docker-linter.js)

Validates a target Dockerfile for security anti-patterns and misconfigurations.

• Checks performed:
  • Root execution (USER root or missing non-root user configuration)
  • Unpinned base image versions (e.g. FROM node:latest or FROM ubuntu)
  • Hardcoded passwords, secrets, or environment keys (ENV DB_PASSWORD=...)
  • Package manager cache bloat (e.g. running apt-get install without cleaning/deleting caches)
  • Dangerous commands (e.g. using curl or wget piping directly to sh, or installing SSH daemons)
• Usage:

  node docker-linter.js <path-to-Dockerfile>

3. IAM Policy Auditor (iam-auditor.js)

Validates AWS IAM policy JSON documents to flag broad access and potential privilege escalation vulnerabilities.

• Checks performed:
  • Wildcard action-resource assignments (Effect: Allow, Action: *, Resource: *)
  • Wildcard operations on broad services (e.g., s3:* on *)
  • Privilege escalation hazards (e.g., actions like iam:CreateAccessKey, iam:PutUserPolicy, or iam:AttachUserPolicy)
  • Insecure service assumptions (e.g., open principal trust relations)
• Usage:

  node iam-auditor.js <path-to-policy.json>

4. SSL & Security Header Checker (security-header-checker.js)

Queries a public target domain over HTTPS to evaluate TLS certificate life and HTTP security header hardening.

• Checks performed:
  • SSL/TLS Certificate Expiry (calculates days remaining, flags if expired or expiring within 30 days)
  • Security Headers presence and strength:
    • Strict-Transport-Security (HSTS)
    • Content-Security-Policy (CSP)
    • X-Frame-Options (Clickjacking prevention)
    • X-Content-Type-Options (MIME sniffing prevention)
    • Referrer-Policy (Leak prevention)
• Usage:

  node security-header-checker.js <domain-name-without-http>
  # Example: node security-header-checker.js github.com