foomo/obacht repository overview

⁠Obacht

obacht inspects your local development setup for security misconfigurations — insecure file permissions, exposed credentials, weak SSH/Git settings, risky Docker access — using an embedded OPA⁠ engine and Rego policies. It is lightweight, read-only, and requires no agent or endpoint management platform.

⁠Demo

⁠Features

• 118 built-in rules across 13 categories: SSH, Git, Docker, Kubernetes, env, shell, tools, PATH, OS, credentials, privacy, Claude Code, bumblebee
• OPA-powered with an embedded Rego engine — no external dependencies
• Read-only collectors — never modifies system state
• Extensible via --rules-dir for custom Rego policies
• Pretty TUI or machine-readable JSON output for CI

⁠Installation

brew install foomo/tap/obacht

docker run --rm foomo/obacht:latest scan

mise use github:foomo/obacht

mise x github:foomo/obacht -- scan

go install github.com/foomo/obacht/cmd/obacht@latest

⁠Usage

$ obacht --help
Security configuration scanner for developer environments

Usage:
  obacht [flags]
  obacht [command]

Available Commands:
  completion  Generate the autocompletion script for the specified shell
  doctor      Check obacht dependencies and configuration
  explain     Show detailed information about a rule
  help        Help about any command
  scan        Scan the local development environment for security issues

Flags:
      --format string      output format (pretty, json) (default "pretty")
  -h, --help               help for obacht
      --rules-dir string   use rules from this directory instead of embedded rules
      --verbose            enable verbose output
  -v, --version            version for obacht

Use "obacht [command] --help" for more information about a command.

⁠Resources

• Foomo Security⁠
• Pareto Security⁠
• NPM Security Best Practices⁠
• Npm installs will hack you⁠
• macOS Security and Privacy Guide⁠

⁠How to Contribute

Contributions are welcome! Please read the contributing guide⁠.

⁠License

Distributed under MIT License, please see license file within the code for more details.

Made with ♥ foomo⁠ by bestbytes⁠