{"id":13841537,"url":"https://github.com/ericalexanderorg/should-i-trust","last_synced_at":"2025-07-11T12:32:38.224Z","repository":{"id":126561974,"uuid":"136742582","full_name":"ericalexanderorg/should-i-trust","owner":"ericalexanderorg","description":"OSINT tool to evaluate the trustworthiness of a company","archived":false,"fork":false,"pushed_at":"2019-12-07T16:49:50.000Z","size":410,"stargazers_count":40,"open_issues_count":3,"forks_count":10,"subscribers_count":3,"default_branch":"master","last_synced_at":"2024-08-05T17:28:24.449Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/ericalexanderorg.png","metadata":{"files":{"readme":"README.md","changelog":"change-log.md","contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null}},"created_at":"2018-06-09T17:03:32.000Z","updated_at":"2024-06-14T07:29:35.000Z","dependencies_parsed_at":"2023-06-17T06:45:41.718Z","dependency_job_id":null,"html_url":"https://github.com/ericalexanderorg/should-i-trust","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ericalexanderorg%2Fshould-i-trust","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ericalexanderorg%2Fshould-i-trust/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ericalexanderorg%2Fshould-i-trust/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ericalexanderorg%2Fshould-i-trust/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/ericalexanderorg","download_url":"https://codeload.github.com/ericalexanderorg/should-i-trust/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":225720420,"owners_count":17513597,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-04T17:01:13.776Z","updated_at":"2024-11-21T11:31:14.680Z","avatar_url":"https://github.com/ericalexanderorg.png","language":"JavaScript","funding_links":[],"categories":["JavaScript","JavaScript (485)"],"sub_categories":[],"readme":"# should-i-trust\n![](https://img.shields.io/github/stars/ericalexanderorg/should-i-trust.svg) \n![](https://img.shields.io/github/forks/ericalexanderorg/should-i-trust.svg) \n![](https://img.shields.io/github/tag/ericalexanderorg/should-i-trust.svg) \n![](https://img.shields.io/github/release/ericalexanderorg/should-i-trust.svg) \n![](https://img.shields.io/github/issues/ericalexanderorg/should-i-trust.svg) \n\n![screenshot](https://github.com/ericalexanderorg/should-i-trust/raw/master/readme-images/flask-screenshot.jpg)\n\n## Summary\n-------------\nshould-i-trust is a tool to evaluate OSINT signals for a domain. \n\n## Requirements\n-------------\nshould-i-trust requires API keys from the following sources:\n\n\n[Censys.io](https://censys.io/register) - Free for for first 250/quries/month\n\n[VirusTotal](https://www.virustotal.com) - Free\n\n[GrayHatWarFare](https://buckets.grayhatwarfare.com/register) - Free with limited results\n\n### Use Case\n-------------\nYou're part of a review board that's responsible for evaluating new vendors. You're specifically responsible for \nensuring new vendors meet compliance and security requirements. \n\nStandard operation procedure is to ask for one or all of the following: SOC report, VSAQ, CAIQ, SIG/SIG-Lite. All \nvendors will not have these reports and/or questionnaire answers. Maybe it's org process to deny vendor intake\nwithout this information, or maybe, this is a \"special\" engagement and you need to ascertain trustworthyness without \nthe docs. Maybe you don't trust the response in the docs. \n\nshould-i-trust is a tool to go beyond standard responses and look for signals that the organization should not be\ntrusted. Maybe they're exposing their CI/CD to the internet with no auth. Maybe they have an EC2 instance with prod\ncode running and no directory restrictions. \n\nshould-i-trust doesn't provide all the information you will need to make a go/no-go decision but it will allow you\nto quickly gather OSINT data for further evaluation. \n\nshould-i-trust is also useful for red team or similar engagements. It can quickly identify targets to probe. \n\n### Setup\n-------------\nEither [install the chrome extension through chrome](https://chrome.google.com/webstore/detail/should-i-trust/hocfamfiidomggjegfgenhgaaifjjmla) or download and manually install in chrome using [developer mode](https://developer.chrome.com/extensions/faq). \n\n### Running\n-------------\n\u003e Open the extension\n\n\u003e Enter your API keys (required once)\n\n\u003e Enter a domain to query\n\n\n### Output\n-------------\n+ If there's an indicator the domain participates in a bug bounty program\n+ Domains found through VirusTotal, Censys.io, and the Google Cert Transparency Report\n+ IPs and open ports found through Censys.io\n+ Repositories found on GitHub, GitLab, and Bitbucket\n+ Misc data found on virustotal.com\n+ AWS bucket files found exposed through GrayHatWarfare\n\n### Road Map\nTBD\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fericalexanderorg%2Fshould-i-trust","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fericalexanderorg%2Fshould-i-trust","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fericalexanderorg%2Fshould-i-trust/lists"}