https://github.com/pmzi/gomrok
Security advisor for ready to serve files
https://github.com/pmzi/gomrok
security security-automation security-scanner security-scanners security-testing security-tools
Last synced: 11 months ago
JSON representation
Security advisor for ready to serve files
- Host: GitHub
- URL: https://github.com/pmzi/gomrok
- Owner: pmzi
- License: mit
- Created: 2021-05-23T08:02:51.000Z (about 5 years ago)
- Default Branch: main
- Last Pushed: 2023-07-01T13:40:08.000Z (about 3 years ago)
- Last Synced: 2025-07-09T12:26:47.305Z (12 months ago)
- Topics: security, security-automation, security-scanner, security-scanners, security-testing, security-tools
- Language: TypeScript
- Homepage:
- Size: 105 KB
- Stars: 5
- Watchers: 1
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# gomrok
`gomrok` is a security advisor for files/folders which are served! `gomrok` basically analyzes your files and folders and gives you security advices.
## Introduction
Generally, any content which is going to be served must be checked for some security vulnerabilities. For example, any files starting with `.` (e.g `.git` folder) should be removed on production and **should not be served**. This is basically what `gomrok` does behind the scene and reports it back to you!
Best practice is to put it on your CI and use it to scan your folder which is going to be served. If there are any vulnerabilities found on your content, `gomrok` will report it to you and the job will be failed.
## Security Checks
For now, `gomrok` does three security checks:
1. Checks for **SensitiveFileExposure**; e.g `.env`
2. Checks for **SensitiveDataExposure**; e.g JWT tokens in the files
3. Checks for **SourceMapLeaks** for front-end apps
## Installation
```
$ npm i -g gomrok
```
## Usage
```
$ gomrok -p ./path/to/be/served
```
Example output:
