_____ ______ _______ _    _ _____  _____ _________     __
  / ____|  ____|/ ______| |  | |  __ \|_   _|__   __\ \  / /
 | (___ | |__  | |    | |  | | |__) | | |    | |   \ \/ /
  \___ \|  __| | |    | |  | |  _  /  | |    | |    \  /
  ____) | |____| |____| |__| | | \ \ _| |_   | |    / /
 |_____/|______|\_____|\_____/|_|  \_\_____|  |_|   /_/
              _   _   _ ___  ___ _____
             /_\ | | | |   \|_ _|_   _|
            / _ \| |_| | |) || |  | |
           /_/ \_\\___/|___/|___| |_|

A comprehensive, single-file security scanner for developer workstations. Checks all installed tools and their dependencies for known vulnerabilities against multiple databases including Google's OSV.dev.

Zero dependencies beyond bash, curl, and python3. No API keys needed.

git clone git@github.com:Neanderthal/security-audit.git
cd security-audit
./security-audit.sh

# Also scan Python virtual environments under one or more paths
./security-audit.sh --venvs ~/Projects
./security-audit.sh --venvs ~/p1 --venvs ~/p2

# Run just one or a few sections (repeatable)
./security-audit.sh --only ssh --only perms

# Skip slow/network sections
./security-audit.sh --skip osv

# Pin the report location and fail (exit 1) if anything was found — useful for CI
./security-audit.sh --report-dir ./report --exit-code

# Section names: system pip npm cargo node nvim ssh perms services osv versions
./security-audit.sh --help

• Arch/Manjaro: arch-audit against Arch Security Advisories
• RHEL/Red OS/Fedora: dnf updateinfo --security against RHEL advisories
• Debian/Ubuntu: apt security updates + debsecan CVE scan (auto-installed)
• openSUSE/SLES: zypper security patches

• Installs pip-audit automatically if missing
• Scans all pip packages against PyPI advisory database
• Reports outdated packages with known fixes
• Checks Python version EOL status (pyenv-aware)

• Lists global packages and checks for outdated versions

• Installs cargo-audit automatically if missing
• Scans against RustSec advisory database
• Checks Rust toolchain update status

• Checks EOL status for installed Node.js version

• Compares installed version against latest GitHub release

• SSH key algorithm and strength (flags RSA < 3072 bits, DSA)
• SSH directory and private key file permissions
• Expired GPG keys

• Checks permissions on ~/.netrc, ~/.git-credentials, ~/.npmrc, ~/.pypirc, ~/.env, ~/.cargo/credentials.toml
• Scans shell configs (~/.bashrc, ~/.zshrc) for hardcoded secrets (tokens, passwords, API keys)

• Lists all open TCP and UDP ports with process names

Queries Google's Open Source Vulnerability database using the batch API (one request per ecosystem, not per package):

For each vulnerability found, reports: CVE/GHSA ID, summary, and CVSS severity score.

Fallback: When native advisory tools are unavailable (e.g., no arch-audit), the script automatically falls back to querying OSV.dev for system packages on supported distros (Debian, Ubuntu, Red Hat, SUSE, Alpine).

Prints versions of all detected tools for reference.

• Color-coded terminal output: [OK] green, [WARN] yellow, [CRIT] red
• Detailed report saved to /tmp/security-audit-YYYYMMDD_HHMMSS/
  • pip-audit.txt — pip-audit raw output
  • pip-outdated.txt — outdated pip packages
  • osv-pypi.json — full CVE details for Python packages
  • osv-crates.io.json — full CVE details for Rust crates
  • osv-npm.json — full CVE details for npm packages
  • summary.txt — total issues count

Security Audit — Wed Apr  2 11:19:19 AM MSK 2026
Host: my-workstation

════════════════════════════════════════════════════════════
  10. CVE DATABASE CHECK (osv.dev)
════════════════════════════════════════════════════════════
  Packages to scan: pip=247, cargo=2, npm=2

  --- PyPI packages ---
  [CRIT] aiohttp 3.12.15 — 18 known CVE(s):
      GHSA-2vrm-gr82-f7m5: AIOHTTP has CRLF injection... (severity: CVSS:4.0/...)
      ...
  [CRIT] cryptography 45.0.4 — 2 known CVE(s):
      ...
  245 packages clean, 32 with known CVEs

════════════════════════════════════════════════════════════
  SUMMARY
════════════════════════════════════════════════════════════
  38 issue(s) found.

• bash
• curl
• python3
• Internet access to api.osv.dev (no auth needed)

Optional (auto-installed if missing):

• pip-audit — for Python advisory checks
• cargo-audit — for Rust advisory checks
• arch-audit — for Arch Linux security checks
• debsecan — for Debian/Ubuntu CVE scanning (auto-installed via apt)

Docker-based smoke tests verify the script runs correctly on all supported distros:

python3 tests/smoke/run_tests.py

Requires docker or podman. Tests cover: Arch, Fedora, Debian, Ubuntu, openSUSE. Each test checks all 11 sections run, correct package manager detection, pip/npm/cargo ecosystem scanning, and OSV.dev integration.

This script runs as your regular user. It uses sudo only for:

• Checking system package updates (dnf updateinfo, apt-get install debsecan)

No data is sent anywhere except package name + version queries to api.osv.dev.

MIT