security_scan.py

"""Scan current text files for literal credentials without printing secret contents."""

from __future__ import annotations

import argparse
import json
import re
from pathlib import Path

TEXT_SUFFIXES = {
    ".py",
    ".md",
    ".toml",
    ".yaml",
    ".yml",
    ".json",
    ".ipynb",
    ".txt",
    ".csv",
    ".example",
}
EXCLUDED_PARTS = {
    ".git",
    ".pytest_cache",
    ".ruff_cache",
    ".ultralytics",
    "__pycache__",
    "models",
    "node_modules",
    ".playwright-cli",
}
PATTERNS = (
    re.compile(
        r"""(?ix)
        (?:api[_-]?key|access[_-]?token|client[_-]?secret)
        \s*[:=]\s*["'][^"'\\\s]{8,}["']
        """
    ),
    re.compile(r"-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----"),
    re.compile(r'(?i)"private_key"\s*:\s*"[^"]{20,}"'),
)


def main() -> int:
    parser = argparse.ArgumentParser()
    parser.add_argument("--root", type=Path, default=Path.cwd())
    parser.add_argument(
        "--output", type=Path, default=Path("reports/security_scan.json")
    )
    args = parser.parse_args()
    root = args.root.resolve()
    private_env = root / ".env"
    gitignore = root / ".gitignore"
    private_env_ignored = False
    if gitignore.is_file():
        ignored_lines = {
            line.strip()
            for line in gitignore.read_text(encoding="utf-8").splitlines()
            if line.strip() and not line.lstrip().startswith("#")
        }
        private_env_ignored = ".env" in ignored_lines
    findings: list[str] = []
    for path in root.rglob("*"):
        if not path.is_file() or any(part in EXCLUDED_PARTS for part in path.parts):
            continue
        if path.resolve() == private_env:
            continue
        if path.suffix.lower() not in TEXT_SUFFIXES and path.name not in {
            ".gitignore",
            ".env",
        }:
            continue
        try:
            content = path.read_text(encoding="utf-8")
        except (OSError, UnicodeDecodeError):
            continue
        if any(pattern.search(content) for pattern in PATTERNS):
            findings.append(str(path.relative_to(root)))
    report = {
        "status": "PASSED" if not findings else "FAILED",
        "credential_like_files": sorted(findings),
        "secrets_printed": False,
        "private_env_present": private_env.is_file(),
        "private_env_ignored": private_env_ignored,
    }
    if private_env.is_file() and not private_env_ignored:
        report["status"] = "FAILED"
        report["credential_like_files"].append(".env (not ignored)")
    args.output.parent.mkdir(parents=True, exist_ok=True)
    args.output.write_text(json.dumps(report, indent=2), encoding="utf-8")
    print(
        "No credentials found"
        if not findings
        else f"Credential-like content found in {len(findings)} file(s)"
    )
    return 0 if not findings else 1


if __name__ == "__main__":
    raise SystemExit(main())