{"id":13701091,"url":"https://github.com/chrisallenlane/drek","last_synced_at":"2025-03-17T16:18:46.981Z","repository":{"id":57216275,"uuid":"94933056","full_name":"chrisallenlane/drek","owner":"chrisallenlane","description":"A static-code-analysis tool for performing security-focused code reviews. It enables an auditor to swiftly map the attack-surface of a large application, with an emphasis on identifying development anti-patterns and footguns.","archived":false,"fork":false,"pushed_at":"2024-07-09T22:59:04.000Z","size":178,"stargazers_count":140,"open_issues_count":5,"forks_count":22,"subscribers_count":8,"default_branch":"master","last_synced_at":"2025-03-05T23:02:54.042Z","etag":null,"topics":["information-security","security-audit","static-code-analysis"],"latest_commit_sha":null,"homepage":"","language":"HTML","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/chrisallenlane.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE.txt","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2017-06-20T20:38:30.000Z","updated_at":"2024-10-14T23:02:36.000Z","dependencies_parsed_at":"2024-10-08T15:16:33.265Z","dependency_job_id":"1d114153-ca36-4916-8985-f1d1e6840d3a","html_url":"https://github.com/chrisallenlane/drek","commit_stats":null,"previous_names":[],"tags_count":5,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/chrisallenlane%2Fdrek","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/chrisallenlane%2Fdrek/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/chrisallenlane%2Fdrek/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/chrisallenlane%2Fdrek/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/chrisallenlane","download_url":"https://codeload.github.com/chrisallenlane/drek/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":243902261,"owners_count":20366259,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["information-security","security-audit","static-code-analysis"],"created_at":"2024-08-02T20:01:17.149Z","updated_at":"2025-03-17T16:18:46.961Z","avatar_url":"https://github.com/chrisallenlane.png","language":"HTML","funding_links":[],"categories":["HTML","HTML (177)"],"sub_categories":[],"readme":"[![Build Status](https://travis-ci.org/chrisallenlane/drek.svg)](https://travis-ci.org/chrisallenlane/drek)\n[![npm](https://img.shields.io/npm/v/drek.svg)]()\n[![npm](https://img.shields.io/npm/dt/drek.svg)]()\n\ndrek\n====\n`drek` is a [static-code-analysis][sca] tool that can be used to perform\nsecurity-focused code reviews. It enables an auditor to swiftly map the\nattack-surface of a large application, with an emphasis on identifying\ndevelopment anti-patterns and footguns.\n\nMuch like `grep`, `drek` scans a codebase for user-defined regular-expressions.\nUnlike `grep`, `drek` outputs its results into an ergonomic `html` report that\nallows for sorting, filtering, and annotating of points-of-interest.\n\n`drek` is the successor to `watchtower` ([project][wt-project],\n[article][wt-article]).\n\n\nInstalling\n----------\n`drek` can be installed via `npm`:\n\n```sh\n[sudo] npm install -g drek\n```\n\n\nExample\n-------\nScan the codebase at `/path/to/app` for the signatures contained within\n`/path/to/signatures/*.yml`:\n\n```sh\ndrek /path/to/app -s '/path/to/signatures/*.yml' -p 'My App' \u003e ./drek-report.html\n```\n\n### Interactive Examples ###\nThe following are reports on the [Damn Vulnerable Web Application][dvwa]:\n\n- [Interactive HTML report][example-html] (save the file and open it locally)\n- [PDF report][example-pdf]\n\n\nUsage\n-----\n### Reports ###\n`drek` can output points-of-interest as `csv`, `html`, `json`, or `xml`, though\nthe `html` report is the primary use-case.\n\nThe `html` report allows auditors to do the following:\n\n- Categorize each point-of-interest by \"severity\".\n- Filter points-of-interest by severity and filetype.\n- Save annotations to `localStorage`.\n- Export a PDF to share audit results.\n\n### Signatures  ###\n`drek` can be configured to scan for any user-defined regular-expressions on a\nper-filetype basis via signature files.\n\nSignature files are `yml` files that conform to a simple schema. See the\n[drek-signatures][] repository for a collection of example signature files.\n\n\n### Configuration ###\n`drek` may optionally be configured via a `~/.drekrc` file\n([example][drekrc-example]) as parsed by [rc][]. It accepts the following\nvalues:\n\n| Property     | Type   | Description                                                            |\n| ------------ | ------ | -----------                                                            |\n| `dateFormat` | string | Report date format, as parsed by [moment.js][].                        |\n| `signatures` | array  | Path to `.yml` signature files to apply. (Accepts [glob][] wildcards.) |\n| `ignore`     | array  | File paths to exclude from scan. (Accepts [glob][] wildcards.)         |\n\n\n[drek-signatures]: https://github.com/chrisallenlane/drek-signatures\n[drekrc-example]: https://github.com/chrisallenlane/drek/blob/master/drekrc-example\n[dvwa]:           http://www.dvwa.co.uk/\n[example-html]:   https://raw.githubusercontent.com/chrisallenlane/drek/master/example/example-report.html\n[example-pdf]:    https://github.com/chrisallenlane/drek/blob/master/example/example-report.pdf\n[glob]:           https://www.npmjs.com/package/glob\n[moment.js]:      https://momentjs.com/\n[rc]:             https://www.npmjs.com/package/rc\n[sca]:            https://en.wikipedia.org/wiki/Static_program_analysis\n[signatures]:     https://github.com/chrisallenlane/drek-signatures\n[wt-article]:     https://chris-allen-lane.com/blog/post/static-code-analysis-using-watchtower\n[wt-project]:     https://github.com/chrisallenlane/watchtower\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fchrisallenlane%2Fdrek","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fchrisallenlane%2Fdrek","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fchrisallenlane%2Fdrek/lists"}