RIP

RIP — Rest In Peace, Vulnerabilities — is a terminal tool for auditing code and sites you are responsible for. It does two things, and is honest that they are small: it finds your own secrets written into your own source, and it checks your own website for the files and headers that most often give a deployment away.

Your secrets, in your code

Generic secret scanners guess at what a key looks like. RIP starts from what your keys actually are. It parses the project's .env, discards values too trivial to mean anything — empty strings, true and false, null, localhost and the like — and then searches every source file for any remaining value written out literally. A match is a real secret in a real file at a real line: the key that was pasted into a config "for a minute", the connection string left in a script. The .env itself is skipped so it does not report itself. With no .env to read, it falls back to the recognisable prefixes of common payment, source-host, chat, cloud and Google keys and tokens.

The search uses grep-searcher, the engine behind ripgrep, over a configurable list of extensions across the usual web and systems languages plus YAML, JSON, XML and Markdown, and skips dependency and build directories by default. Every scan writes a log file, and in that log matched values are masked — long hex strings, payment-style keys, and anything assigned to a key, secret, password or token — so the report is not itself a new place the secret lives.

Your site, from the outside

The web check is off by default and runs only against a URL you pass. It requests a short list of paths that should never be served publicly — .env, .git/config and .git/HEAD, SQL dumps, config.php and wp-config.php, .htaccess, admin, debug, test and database-console paths — and rates each one that answers, from critical for an exposed environment file or repository down to low. It reads robots.txt for paths it discloses, and it checks the response for missing Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and X-XSS-Protection headers, and for a weak X-Frame-Options value. Each finding comes with a severity and a recommendation.

Interactive or unattended

Run with no arguments and RIP walks through a set-up with multi-select menus for extensions, ignore patterns and the web check, then saves the answers to a TOML file a team can commit and share. --auto runs with defaults and no prompts, for a CI step; --quiet and --verbose control output, and progress bars and severity colours switch off cleanly when the terminal is not interactive. It only reads: it never modifies a file and sends nothing anywhere except the requests the web check makes to the URL you gave it.

Status

Alpha, written in July 2025 with unit and integration tests and a clean clippy run, and kept current since with dependency updates. A release workflow builds binaries for Linux, macOS and Windows on x64 and ARM, and an npm wrapper runs the binary through npx. Still to come: JSON output (the flag is parsed but not yet implemented), entropy-based detection, custom patterns, and scanning git history for secrets that were committed and later removed.