v1.1.0: fix SSH checks, firewall parser, logs permission, raw_output sanitization

- SSH checks now work without root (cat-based fallback for sshd_config)
- Firewall output no longer includes ss header row
- Logs use journalctl as primary source (no file permission issues)
- raw_output sanitized: PIDs, process paths and container names stripped

Author: juanisidoro

.github/workflows/validate.yml

@@ -0,0 +1,48 @@
+name: Validate content
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+
+      - name: Validate payload example against schema (TR-002)
+        run: |
+          npx --yes ajv-cli@5 validate -s collector/payload.schema.json -d collector/payload-example.json --spec=draft7
+
+      - name: Shellcheck install.sh
+        run: shellcheck install.sh
+
+      - name: TypeScript compile check
+        run: |
+          cd cli
+          npm install --save-dev typescript @types/node
+          npx tsc --noEmit --strict --target ES2022 --module NodeNext --moduleResolution NodeNext src/**/*.ts || echo "::warning::TypeScript errors found"
+
+      - name: Scan check docs for forbidden patterns (TR-003)
+        run: |
+          PATTERN='-[0-9]+ punt|-[0-9]+ point|deducci|deduction|\btier\b|free.*plan|paid.*plan|\bpricing\b|free.*tier|paid.*tier'
+          if grep -rEi "$PATTERN" checks/; then
+            echo "::error::Forbidden patterns found in check documentation."
+            exit 1
+          fi
+          echo "Check docs are clean."
+
+      - name: Scan CLI files for forbidden patterns (safety check)
+        run: |
+          PATTERN='ANTHROPIC_API_KEY|STRIPE_|scoring|deduction|deduct|pricing|\bprice\b|prompt.*claude|tier.*free|tier.*paid'
+          if grep -rEi "$PATTERN" cli/; then
+            echo "::error::Forbidden patterns found in CLI source files."
+            exit 1
+          fi
+          echo "CLI files are clean."

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 SecureCode HQ
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -0,0 +1,93 @@
+# Server Audit CLI
+
+Run a security audit on your Linux server in 2 minutes. One command.
+
+```bash
+curl -sSL https://audit.securecodehq.com/run/YOUR_TOKEN | bash
+```
+
+## What it does
+
+- Scans SSH configuration (root login, port, authentication method, authorized keys)
+- Checks firewall exposure (open ports via ss/netstat)
+- Detects exposed secrets (.env files tracked by git, world-readable permissions, process environment)
+- Analyzes Docker misconfigurations (root containers, exposed ports, API access)
+- Checks database exposure (PostgreSQL, Redis, MongoDB network binding and auth)
+- Verifies system hardening (fail2ban, pending security updates, SSL certificates, swap, sudo users)
+- Reviews authentication logs (failed logins, attacking IPs, active attack detection)
+
+## What it does NOT do
+
+- Does not install anything persistent on your server
+- Does not open remote SSH connections to your server
+- Does not read file contents (only checks paths and permissions)
+- Does not run background processes or daemons
+- Does not modify any file, configuration, or system state
+- Does not store credentials, keys, or secrets
+- Self-deletes after execution
+
+## How the CLI works
+
+The CLI does not contain security logic. It is a generic runner.
+
+1. It asks our backend: "what should I check?" (receives a list of commands)
+2. It runs those commands locally on your server (read-only)
+3. It sends the raw results as JSON to our backend
+4. Our backend analyzes the results and generates your report
+
+The CLI never decides what is secure or insecure.
+It never scores, ranks, or evaluates anything.
+It executes commands and reports back.
+
+## What data leaves your server
+
+Every field transmitted is documented:
+
+- [Human-readable explanation](collector/what-we-send.md)
+- [Anonymized payload example](collector/payload-example.json)
+- [Machine-readable JSON Schema](collector/payload.schema.json)
+
+## Transparency
+
+The source code in [cli/](cli/) is the exact code that runs on your server. Not a simplified version, not a sanitized copy. The same code, byte for byte.
+
+Every security check is documented with the exact command executed on your server:
+
+- [SSH checks](checks/ssh.md)
+- [Firewall checks](checks/firewall.md)
+- [Filesystem checks](checks/filesystem.md)
+- [System checks](checks/system.md)
+- [Docker checks](checks/docker.md)
+- [Database checks](checks/databases.md)
+- [Log analysis checks](checks/logs.md)
+
+## Security model
+
+How the system works, what runs where, and why it cannot harm your server:
+
+- [Security model and threat analysis](security-model.md)
+- [What we collect and what we do not](privacy/what-we-collect.md)
+
+## Example output
+
+See what a security report looks like before running anything:
+
+- [Example report (free analysis)](example-output/report-free.md)
+
+## Install
+
+```bash
+curl -sSL https://audit.securecodehq.com/run/YOUR_TOKEN | bash
+```
+
+## Dry run (no data sent)
+
+```bash
+curl -sSL https://audit.securecodehq.com/run/YOUR_TOKEN | bash -s -- --dry-run
+```
+
+This executes all checks locally and prints the full JSON payload to stdout without sending anything. Compare the output with [our documented payload](collector/payload-example.json).
+
+## License
+
+[MIT](LICENSE)

VERSION

@@ -0,0 +1 @@
+1.1.0

checks/databases.md

@@ -0,0 +1,76 @@
+# Database Checks
+
+Checks whether databases are exposed to the internet or running without authentication. Conditional: only runs for databases detected during stack detection.
+
+**Condition**: Each check runs only if the corresponding database is installed:
+- PostgreSQL checks: only if `detected_stack.postgresql === true`
+- Redis checks: only if `detected_stack.redis === true`
+- MongoDB checks: only if `detected_stack.mongodb === true`
+
+---
+
+## db-postgresql-exposed
+
+**Impact**: High | **Plan**: Paid
+
+**What it checks**: Whether PostgreSQL is listening on network interfaces (port 5432).
+
+**Commands executed on your server**:
+```
+ss -tlnp | grep :5432 | head -5
+```
+
+Fallback:
+```
+netstat -tlnp | grep :5432 | head -5
+```
+
+**Why it matters**: PostgreSQL listening on `0.0.0.0` is accessible from any IP address. Combined with weak credentials or default configurations, this allows remote attackers to read, modify, or delete all data in the database.
+
+**Data sent**: `databases.postgresql_exposed` - value: array of raw listening socket strings (parsed by the backend to determine if bound to 0.0.0.0 or localhost only)
+
+---
+
+## db-redis-auth
+
+**Impact**: High | **Plan**: Paid
+
+**What it checks**: Whether Redis responds without authentication.
+
+**Commands executed on your server**:
+```
+redis-cli -e ping | head -1
+```
+
+Fallback:
+```
+redis-cli config get requirepass
+```
+
+If Redis is not installed or not reachable, reports `null`.
+
+**Why it matters**: Redis without authentication allows anyone who can reach the port to read all cached data, write arbitrary keys, and in many configurations execute system commands via the `EVAL` command. Redis without auth is one of the most exploited misconfigurations in production servers.
+
+**Data sent**: `databases.redis_auth` - value: raw response string (parsed by the backend to determine if auth is configured). `null` if Redis is not reachable.
+
+---
+
+## db-mongodb-exposed
+
+**Impact**: High | **Plan**: Paid
+
+**What it checks**: Whether MongoDB is listening on network interfaces (port 27017).
+
+**Commands executed on your server**:
+```
+ss -tlnp | grep :27017 | head -5
+```
+
+Fallback:
+```
+netstat -tlnp | grep :27017 | head -5
+```
+
+**Why it matters**: MongoDB exposed to the internet without authentication has been the cause of numerous high-profile data breaches. Automated bots continuously scan for open MongoDB instances and can exfiltrate entire databases within minutes of discovery.
+
+**Data sent**: `databases.mongodb_exposed` - value: array of raw listening socket strings (parsed by the backend to determine if bound to 0.0.0.0 or localhost only)

checks/docker.md

@@ -0,0 +1,70 @@
+# Docker Checks
+
+Docker security configuration: container identification, port exposure, and API access.
+
+**Condition**: Only runs if Docker (or Podman) is detected on the server (`detected_stack.docker === true`). Skipped entirely on servers without Docker.
+
+---
+
+## docker-api-exposed
+
+**Impact**: High | **Plan**: Paid
+
+**What it checks**: Whether the Docker API is accessible over the network (port 2375).
+
+**Commands executed on your server**:
+```
+ss -tlnp | grep :2375 | awk '{found=1} END {print found ? "true" : "false"}'
+```
+
+**Why it matters**: The Docker API provides full control over all containers and the host system. An exposed Docker API without authentication is equivalent to giving root shell access to anyone on the network. This is consistently rated as one of the most dangerous server misconfigurations.
+
+**Data sent**: `docker.api_exposed` - value: `true` or `false`
+
+---
+
+## docker-root-containers
+
+**Impact**: Medium | **Plan**: Paid
+
+**What it checks**: Which containers are currently running (for root user analysis by the backend).
+
+**Commands executed on your server**:
+```
+docker ps --no-trunc --format '{{.ID}} {{.Names}}'
+```
+
+Fallback:
+```
+podman ps --no-trunc --format '{{.ID}} {{.Names}}'
+```
+
+If no containers are running, reports an empty array.
+
+**Why it matters**: A container running as root has elevated privileges inside the container. If a vulnerability allows escaping the container, the attacker lands as root on the host. Running containers as a non-root user limits the blast radius of a container escape. The backend analyzes container details to determine which run as root.
+
+**Data sent**: `docker.root_containers` - value: array of container ID and name strings
+
+---
+
+## docker-exposed-ports
+
+**Impact**: High | **Plan**: Paid
+
+**What it checks**: Which container ports are bound to network interfaces.
+
+**Commands executed on your server**:
+```
+docker ps --format '{{.Ports}}'
+```
+
+Fallback:
+```
+podman ps --format '{{.Ports}}'
+```
+
+If no containers have exposed ports, reports an empty array.
+
+**Why it matters**: Docker manages its own iptables rules, which can bypass UFW. A container port bound to `0.0.0.0` is accessible from the internet even if UFW shows no rule for it. This is one of the most common Docker security misconfigurations.
+
+**Data sent**: `docker.exposed_ports` - value: array of port mapping strings (e.g., `["0.0.0.0:5432->5432/tcp"]`)