{"id":32274787,"url":"https://github.com/mathtechstudio/ohmyg0sh","last_synced_at":"2026-01-22T00:01:23.193Z","repository":{"id":318355129,"uuid":"1070849877","full_name":"mathtechstudio/ohmyg0sh","owner":"mathtechstudio","description":"Lightweight Dart package for detecting possible API key or secret leaks using regex signatures.","archived":false,"fork":false,"pushed_at":"2025-10-08T12:49:19.000Z","size":113,"stargazers_count":2,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2025-10-22T23:42:35.267Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"https://pub.dev/packages/ohmyg0sh","language":"Dart","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/mathtechstudio.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2025-10-06T14:16:30.000Z","updated_at":"2025-10-08T20:20:54.000Z","dependencies_parsed_at":"2025-10-06T18:42:52.703Z","dependency_job_id":null,"html_url":"https://github.com/mathtechstudio/ohmyg0sh","commit_stats":null,"previous_names":["mathtechstudio/ohmyg0sh"],"tags_count":3,"template":false,"template_full_name":null,"purl":"pkg:github/mathtechstudio/ohmyg0sh","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mathtechstudio%2Fohmyg0sh","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mathtechstudio%2Fohmyg0sh/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mathtechstudio%2Fohmyg0sh/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mathtechstudio%2Fohmyg0sh/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/mathtechstudio","download_url":"https://codeload.github.com/mathtechstudio/ohmyg0sh/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mathtechstudio%2Fohmyg0sh/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":28647469,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-01-21T21:29:11.980Z","status":"ssl_error","status_checked_at":"2026-01-21T21:24:31.872Z","response_time":86,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.5:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2025-10-22T23:39:56.586Z","updated_at":"2026-01-22T00:01:23.118Z","avatar_url":"https://github.com/mathtechstudio.png","language":"Dart","funding_links":[],"categories":[],"sub_categories":[],"readme":"# ohmyg0sh\n\n![Pub Version](https://img.shields.io/pub/v/ohmyg0sh)\n![Release CI](https://github.com/mathtechstudio/ohmyg0sh/actions/workflows/release.yml/badge.svg)\n![License](https://img.shields.io/badge/license-MIT-blue.svg)\n![Platforms](https://img.shields.io/badge/platforms-Android%20%7C%20iOS%20%7C%20macOS%20%7C%20Windows-informational)\n\nohmyg0sh is an APK security scanner that decompiles packages with `jadx`, applies a curated library of credential and secret patterns, filters false positives, and produces text or JSON reports.\n\n## Table of Contents\n\n- [ohmyg0sh](#ohmyg0sh)\n  - [Table of Contents](#table-of-contents)\n  - [Features](#features)\n    - [Recent Improvements (v1.71.0)](#recent-improvements-v1710)\n  - [Installation](#installation)\n    - [Global CLI (Recommended)](#global-cli-recommended)\n    - [Project Dependency](#project-dependency)\n    - [Docker](#docker)\n  - [Requirements](#requirements)\n    - [Installing jadx](#installing-jadx)\n  - [Quick Start](#quick-start)\n    - [CLI](#cli)\n    - [Programmatic API](#programmatic-api)\n  - [Configuration](#configuration)\n    - [Custom Patterns (`regexes.json`)](#custom-patterns-regexesjson)\n    - [False Positive Filters (`notkeyhacks.json`)](#false-positive-filters-notkeyhacksjson)\n  - [Built-in Patterns](#built-in-patterns)\n  - [Output Examples](#output-examples)\n    - [Text](#text)\n    - [JSON](#json)\n  - [CLI Reference](#cli-reference)\n  - [How It Works](#how-it-works)\n  - [Troubleshooting](#troubleshooting)\n    - [`jadx` Not Found](#jadx-not-found)\n    - [`jadx` Exits with Errors](#jadx-exits-with-errors)\n    - [Custom Pattern Resolution](#custom-pattern-resolution)\n  - [Docker Usage](#docker-usage)\n  - [Development](#development)\n  - [Contributing](#contributing)\n  - [Security Notes](#security-notes)\n  - [Acknowledments](#acknowledments)\n  - [License](#license)\n\n## Features\n\n- Scan Android APKs for hardcoded credentials before release\n- 50+ bundled regex patterns covering major cloud, social, payment, and developer platforms\n- Customizable detection rules and false-positive filters\n- Human-readable text reports and machine-friendly JSON output\n- Streamed CLI updates with noisy jadx error lines suppressed\n- Programmatic API and Docker image for automation pipelines\n\n### Recent Improvements (v1.71.0)\n\n- Structured error types (`ApkError`, `JadxError`, `ConfigurationError`, `ScanError`)\n- Configurable concurrency control (default: 16, adjustable via `scanConcurrency`)\n- Progress reporting for long-running scans\n- Enhanced enums and type-safe data models\n- Modular architecture with utility classes\n- Comprehensive API documentation with usage examples\n\n## Installation\n\n### Global CLI (Recommended)\n\n```bash\ndart pub global activate ohmyg0sh\n\n# then\nohmyg0sh -f app-release.apk\n```\n\n### Project Dependency\n\n```yaml\ndependencies:\n  ohmyg0sh: ^1.70.0\n```\n\n```bash\ndart pub get\n```\n\n### Docker\n\n```bash\ndocker pull mathtechstudio/ohmyg0sh:latest\ndocker run -it --rm -v \"$PWD\":/work -w /work mathtechstudio/ohmyg0sh:latest -f /work/app-release.apk\n```\n\n## Requirements\n\n- **Dart SDK** ^3.5\n- **Java** 11 or newer (required by `jadx`)\n- **jadx** installed and available on `PATH`, or passed with `--jadx`\n\n### Installing jadx\n\n```bash\n# macOS\nbrew install jadx\n\n# Linux / Windows\n# Download from https://github.com/skylot/jadx/releases and add the binary to PATH\n```\n\n## Quick Start\n\n### CLI\n\n```bash\n# Basic scan\nohmyg0sh -f app-release.apk\n\n# JSON results\nohmyg0sh -f app-release.apk --json -o results.json\n\n# Custom patterns \u0026 extra jadx flags\nohmyg0sh -f app-release.apk -p custom/regexes.json -a \"--deobf --log-level INFO\"\n```\n\n\u003e [!TIP]\n\u003e If your output file name starts with `-`, provide the path as `--output=./-results.json` to avoid option parsing issues.\n\n### Programmatic API\n\n```dart\nimport 'package:ohmyg0sh/ohmyg0sh.dart';\n\nFuture\u003cvoid\u003e main() async {\n  final scanner = OhMyG0sh(\n    apkPath: './app-release.apk',\n    outputJson: true,\n    outputFile: 'results.json',\n  );\n\n  await scanner.run();\n}\n```\n\n**Advanced Usage with Error Handling:**\n\n```dart\nimport 'package:ohmyg0sh/ohmyg0sh.dart';\n\nFuture\u003cvoid\u003e main() async {\n  final scanner = OhMyG0sh(\n    apkPath: './app-release.apk',\n    outputJson: true,\n    outputFile: 'results.json',\n    scanConcurrency: 32,        // Adjust for performance\n    showProgress: true,          // Display progress\n    continueOnJadxError: true,  // Continue on partial failures\n  );\n\n  try {\n    await scanner.run();\n    print('✓ Scan completed successfully');\n  } on ApkError catch (e) {\n    print('❌ APK Error: ${e.message}');\n  } on JadxError catch (e) {\n    print('❌ JADX Error: ${e.message}');\n  } on ConfigurationError catch (e) {\n    print('❌ Configuration Error: ${e.message}');\n  } catch (e) {\n    print('❌ Unexpected Error: $e');\n  }\n}\n```\n\nFor detailed error scenarios and solutions, see [ERROR_SCENARIOS.md](ERROR_SCENARIOS.md).\n\n## Configuration\n\n### Custom Patterns (`regexes.json`)\n\n```json\n// your-fucking-rules.json\n{\n  \"Google_API_Key\": \"AIza[0-9A-Za-z\\\\-_]{35}\",\n  \"AWS_Access_Key\": \"AKIA[0-9A-Z]{16}\",\n  \"Custom_Token\": \"myapp_[a-f0-9]{32}\"\n  // ...\n}\n```\n\nUse via `ohmyg0sh -f app.apk -p my-patterns.json`.\n\n### False Positive Filters (`notkeyhacks.json`)\n\n```json\n{\n  \"patterns\": [\"example\\\\.com\"],\n  \"contains\": [\"PLACEHOLDER\"],\n  \"Google_API_Key\": [\"AIzaGRAPHIC_DESIGN\"]\n}\n```\n\nUse via `ohmyg0sh -f app.apk -n my-filters.json`.\n\n## Built-in Patterns\n\nBundled rules detect secrets across:\n\n- **Cloud**: AWS, Google Cloud, Azure, DigitalOcean\n- **Social \u0026 Comms**: Facebook, Twitter, Slack, Discord\n- **Payments**: Stripe, PayPal, Square, Braintree\n- **Developer Services**: GitHub, GitLab, Mailgun, Cloudinary\n- **Databases \u0026 Keys**: MongoDB, Postgres, private key blocks\n\nReview the full list in [config/regexes.json](config/regexes.json).\n\n## Output Examples\n\n### Text\n\n```bash\n** Scanning against 'com.example.app'\n\n[Google_API_Key]\n- AIzaSyD...\n\n** Results saved into 'results_1234567890.txt'.\n```\n\n### JSON\n\n```json\n{\n  \"package\": \"com.example.app\",\n  \"results\": [\n    {\n      \"name\": \"Google_API_Key\",\n      \"matches\": [\"AIzaSyD...\"]\n    }\n  ],\n  \"generated_at\": \"2025-10-07T14:00:00Z\",\n  \"generated_by\": \"ohmyg0sh\",\n  \"repository\": \"https://github.com/mathtechstudio/ohmyg0sh\",\n  \"pub_dev\": \"https://pub.dev/packages/ohmyg0sh\"\n}\n```\n\n## CLI Reference\n\n| Option      | Short | Description                                  |\n| ----------- | ----- | -------------------------------------------- |\n| `--file`    | `-f`  | APK file to scan (required)                  |\n| `--output`  | `-o`  | Output file path (auto-generated if missing) |\n| `--json`    |       | Emit JSON instead of text                    |\n| `--pattern` | `-p`  | Custom `regexes.json` file                   |\n| `--notkeys` | `-n`  | Custom `notkeyhacks.json` file               |\n| `--jadx`    |       | Explicit path to the `jadx` binary           |\n| `--args`    | `-a`  | Additional `jadx` arguments (quoted)         |\n| `--help`    | `-h`  | Show usage                                   |\n\n## How It Works\n\n1. **Decompile** APK with `jadx`\n2. **Extract** package metadata\n3. **Scan** Java, Kotlin, Smali, XML, JS, and TXT sources\n4. **Match** regex patterns against file contents\n5. **Filter** via `notkeyhacks` rules\n6. **Report** grouped matches to disk in the requested format\n\n## Troubleshooting\n\n### `jadx` Not Found\n\n```bash\nbrew install jadx       # macOS\nwhich jadx \u0026\u0026 jadx --version\n```\n\nOr run with `--jadx /custom/path/to/jadx`.\n\n### `jadx` Exits with Errors\n\nOhMyG0sh continues when usable artifacts exist and suppresses the noisy `ERROR - finished with errors` line. For verbose logs use:\n\n```bash\nohmyg0sh -f app.apk -a \"--log-level DEBUG\"\n```\n\n### Custom Pattern Resolution\n\nSearch order:\n\n1. `--pattern` path (if provided)\n2. `/app/config/regexes.json` (Docker image)\n3. `package:ohmyg0sh/config/regexes.json` (pub install)\n4. `./config/regexes.json`\n5. Executable-relative fallback\n\n## Docker Usage\n\n```bash\nalias ohmyg0sh='docker run --rm -it -v \"$PWD\":/work -w /work mathtechstudio/ohmyg0sh:latest'\nohmyg0sh -f app-release.apk\n```\n\nWith custom patterns:\n\n```bash\ndocker run -it --rm \\\n  -v \"$PWD\":/work \\\n  -v \"$PWD/patterns.json\":/patterns.json \\\n  -w /work \\\n  mathtechstudio/ohmyg0sh:latest \\\n  -f /work/app.apk -p /patterns.json\n```\n\n## Development\n\n```bash\ngit clone https://github.com/mathtechstudio/ohmyg0sh.git\ncd ohmyg0sh\ndart pub get\ndart run bin/ohmyg0sh.dart -f app-release.apk\ndart test\n```\n\n## Contributing\n\n1. Fork the repository\n2. Create a feature branch\n3. Implement and test your changes\n4. Submit a pull request\n\n## Security Notes\n\n- Use only on APKs you are authorized to assess\n- Review findings manually to confirm leaks\n- Rotate exposed credentials immediately\n- Report vulnerabilities responsibly\n\n## Acknowledments\n\nSince this tool includes some contributions, and I'm not an asshole, I'll publically thank the following users for their helps and resources:\n\n| Contributors                                                                                                                                |\n| ------------------------------------------------------------------------------------------------------------------------------------------- |\n| [![Contributors](https://contrib.rocks/image?repo=mathtechstudio/ohmyg0sh)](https://github.com/mathtechstudio/ohmyg0sh/graphs/contributors) |\n\n## License\n\nReleased under the MIT License - see the [MIT License](LICENSE) file for details.\n\n---\n\n[Star on GitHub](https://github.com/mathtechstudio/ohmyg0sh) | [View on pub.dev](https://pub.dev/packages/ohmyg0sh) | [Docker](https://hub.docker.com/r/mathtechstudio/ohmyg0sh) | [Report Issues](https://github.com/mathtechstudio/darturbation/issues)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmathtechstudio%2Fohmyg0sh","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmathtechstudio%2Fohmyg0sh","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmathtechstudio%2Fohmyg0sh/lists"}