securescan-framework - Defensive security scanning framework with a Rust

项目说明

SecureScan Framework

SecureScan is an open-source, defensi scanning framework for repositories and software that you are authorized to assess. It starts with a memory-safe Rust core and produces explainable findings in text or JSON format.

> SecureScan does not claim to prove or disco Zero-Day or Zero-Click . It does not execute scanned files or exploit payloads. Findings are re indicators that require human and authorized testing.

Current Status

The initial release safely enumerates text files, skips common dependency and build directories, and detects selected indicators associated with encoded PowerShell, remote content piped into a shell, shell network redirection, and potentially non-constant-time comparisons. Rules are isolated from the scanning and reporting layers so that AST analysis, taint analysis, and Python-managed rules can be added incrementally.

Installation

Linux

Install the Rust toolchain using the official installer:

Clone the repository, build it, and run the tests:

The compiled binary is a at target/release/scanner-core.

Windows PowerShell

Install Rust through rustup.rs or run the following command in PowerShell:

Restart PowerShell, then clone and build the project:

The compiled binary is a at target\\release\\scanner-core.exe.

Termux on Android

Install the current Termux build from F-Droid or another trusted official distribution. Avoid mixing Termux packages from different sources because repository and ABI mismatches can break nati.

The recommended one-command installer is:

For a fully local and auditable installation, download the repository first and execute the script from disk:

The installer checks that it is running in Termux, detects common Android architectures, installs git, rust, clang, make, and pkg-config, requests shared-storage access only when needed, builds with one Cargo job to reduce memory pressure, runs the test suite, and creates a securescan command in $PREFIX/bin.

After installation:

If Android terminates the build, keep at least several hundred megabytes free, close background apps, use CARGO_BUILD_JOBS=1, and build inside $HOME rather than shared storage. Termux support is intended for authorized local repository analysis; do not scan data you do not own or ha to assess.

Usage

Python entry point

The recommended user-facing entry point is Securescan.py. It uses only Python's standard library and delegates scanning to the Rust core. When no format is specified, it opens the interactive TUI:

To select an output mode explicitly:

On Termux, run it from the installed project directory:

The wrapper reports a clear message if the Rust binary has not been built yet. The installer builds it automatically.

Interacti UI

Launch the interacti interface with the tui format. It works in terminals on Linux, Windows PowerShell, and Termux:

The TUI shows the scan summary, findings list, se colors, location, confidence, trace, and remediation guidance. Use the Up/Down keys to select a finding and q or Esc to exit. The TUI is a presentation layer over the same read-only scanner; it does not execute scanned files.

Non-interacti

Scan a repository and print a human-readable report:

Write a structured JSON report:

On Windows PowerShell, use a Windows path such as:

The scanner avoids symbolic-link tra, skips binary files, ignores common build/dependency directories, and limits indi files to 2 MiB in the current core implementation.

Architecture

The architecture and design constraints are documented in docs/architecture.md. The Rust crate is organized as follows:

| Module | Responsibility |
|---|---|
| model.rs | Serializable findings, locations, traces, se, and confidence. |
| rules.rs | Explainable, testable defensi rules. |
| scanner.rs | Read-only file enumeration and safe text scanning. |
| report.rs | Human-readable and JSON report rendering. |
| main.rs | Minimal command-line interface. |

Roadmap

Planned work includes Python orchestration for YAML-managed rules, SARIF output, a read-only GitHub Action, language-aware AST analysis, bounded taint tracking, and isolated dynamic-analysis adapters. Symbolic execution and DAST will require explicit opt-in, resource limits, and sandboxing; they will not run by default.

Contributing

Please include a test with every new rule, document the reason for the alert and its remediation, and ne real secrets or weaponized exploit payloads. Contributions must remain aligned with authorized, defensi research.

License

Apache-2.0. Author: Manus AI.

References

项目信息

开发语言：Python

Star 数：1

技术要点

该项目属于防护思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Defensive security scanning framework with a Rust core and explainable findings展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。