PledgeShield

Personal device security auditor for Windows, macOS, and Linux — finds what antivirus misses.

PledgeShield is designed to be used with an AI assistant. For the best experience, have your AI analyze COMMANDS.md before running commands — it contains the complete command reference and examples.

PledgeShield is a Rust-based host security auditor for Windows, macOS, and Linux. It scans your device for misconfigurations, exposed services, unpatched software, privilege escalation vectors, and other attack surfaces that antivirus software doesn't look at.

Think lynis — but cross-platform, in Rust, one binary, no agent, no server.

Antivirus (Microsoft Defender, XProtect, ClamAV, etc.) focuses on malware detection — catching known bad files in real-time. It does NOT assess:

• Whether your RDP/SSH is exposed to the internet
• Whether UAC (Windows) / Gatekeeper (macOS) / AppArmor (Linux) is properly configured
• Whether you have unnecessary services running
• Whether your installed software has known unpatched CVEs
• Whether someone left a scheduled task / launchd / cron for persistence
• Whether your file shares are open to everyone
• Whether stored credentials are sitting in plaintext

PledgeShield fills this gap. Run it, get a report, fix the issues.

# Run a full security audit
pledgeshield scan

# Scan with CVE checking and compliance mapping
pledgeshield scan --cve --compliance --format html --output report.html

# Harden your system (120+ hardening modules)
pledgeshield harden firewall --harden --allow-ssh
pledgeshield harden ports --all
pledgeshield harden doh --enable cloudflare
pledgeshield harden sysctl --harden
pledgeshield harden ssh --harden

# Real-time monitoring
pledgeshield monitor

# Check your security posture score
pledgeshield harden posture

cargo install pledgeshield

brew install pledgeandgrow/tap/pledgeshield

winget install PledgeAndGrow.PledgeShield

wget -qO - https://pledgeandgrow.github.io/pledgeshield/apt/pledgeshield-apt-public.key \
  | sudo gpg --dearmor -o /usr/share/keyrings/pledgeshield.gpg
echo "deb [signed-by=/usr/share/keyrings/pledgeshield.gpg] https://pledgeandgrow.github.io/pledgeshield/apt stable main" \
  | sudo tee /etc/apt/sources.list.d/pledgeshield.list
sudo apt update && sudo apt install pledgeshield

npm install -g pledgeshield

pip install pledgeshield

gem install pledgeshield

dotnet tool install -g PledgeShield

Download from GitHub Releases — prebuilt binaries for Linux (x86_64, aarch64), macOS (Intel, Apple Silicon), and Windows (x86_64).

pledgeshield <COMMAND>

Commands:
  scan         Run a security scan
  init-config  Generate a sample config file
  history      Show scan history from the local SQLite database
  trend        Show a trend dashboard from scan history
  schedule     Install or remove a scheduled scan (cron / Task Scheduler / launchd)
  harden       Active defense: 120+ hardening modules
  vpn          VPN / proxy management (WireGuard, OpenVPN, Tor)
  monitor      Real-time security monitor

See COMMANDS.md for the full command reference.

Windows:

• UAC status and level
• SmartScreen status
• Windows Firewall profile rules (Domain, Private, Public)
• Windows Defender status and exclusions
• BitLocker / encryption status
• Windows telemetry settings
• Clipboard history exposure
• Wi-Fi Sense sharing
• Auto-login configuration

macOS:

• Gatekeeper status and spctl assessment
• SIP (System Integrity Protection) status
• FileVault encryption status
• XProtect & MRT status
• macOS firewall (Application Firewall) status
• TCC (Transparency, Consent, Control) permissions audit
• System telemetry settings
• Auto-login configuration

Linux:

• AppArmor or SELinux status and mode
• Firewall status (ufw / firewalld / iptables / nftables)
• Disk encryption status (LUKS)
• PAM configuration audit
• Kernel hardening (sysctl params: ASLR, dmesg restriction, etc.)
• Automatic updates configuration
• /etc/permissions and file ownership audit

• All running services with startup type
• Services running as root/SYSTEM (high privilege)
• Listening ports and associated processes
• Ports exposed to public (0.0.0.0) vs localhost only
• RDP, SSH, SMB, WinRM, VNC exposure check
• Unnecessary services recommendation

• Enumerate installed software (platform-specific package managers)
• Check each program against CVE APIs (no manual database to maintain)
• Report unpatched versions with severity and CVE ID
• Suggest update actions

CVE data sources (API-based, no manual updates needed):

• NVD API 2.0 — National Vulnerability Database
• OSV.dev API — Open Source Vulnerabilities, Google-backed
• GitHub Security Advisories API — GHSA database
• FIRST EPSS API — Exploit prediction scoring for prioritization

• All local user accounts and their privileges
• Administrator / sudo group membership
• Guest account status
• Password policy (length, complexity, expiration, lockout)
• Users with "Password never expires" flag
• Suspicious hidden accounts

• Scheduled tasks / cron / launchd (suspicious entries, unknown authors, odd triggers)
• Registry Run keys (Windows) / LaunchAgents (macOS) / systemd timers (Linux)
• Startup folder entries
• Services with suspicious paths
• WMI event subscriptions (Windows)
• DLL hijacking opportunities (Windows) / writable dirs in PATH (all)

• Stored Windows credentials / macOS Keychain / Linux keyring
• Saved RDP sessions (Windows)
• Browser saved passwords (Chrome, Edge, Firefox, Brave, Safari detection)
• Wi-Fi profiles with stored passwords
• SSH keys with no passphrase
• Generic credentials in Credential Manager / Keychain

• All file/printer shares and their permissions (Windows/SMB)
• Shares accessible to "Everyone" or "Anonymous"
• Default admin shares (C$, D$, ADMIN$)
• SMB configuration (SMBv1 check, signing requirements)
• RDP configuration (NLA requirement, encryption level)
• NFS exports (Linux)
• AFP/SMB shares (macOS)

• Missing OS updates (Windows Update / softwareupdate / apt/dnf/pacman)
• Last successful update check date
• Pending reboot for installed updates
• Third-party software update status (winget, brew, choco)

• Installed browser extensions (Chrome, Edge, Firefox, Brave)
• Known-malicious extension detection
• Excessive permission flags

• Docker/Podman/Kubernetes misconfiguration
• Privileged containers, root user, no seccomp
• Exposed ports, no resource limits

• CIS Benchmark control IDs
• NIST SP 800-53 control IDs
• Custom checks from TOML/YAML files

120+ modules that take action to secure your system. See MODULES.md for the full list.

# WireGuard / OpenVPN
pledgeshield vpn status
pledgeshield vpn connect --config myvpn --vpn-type wireguard
pledgeshield vpn disconnect
pledgeshield vpn kill-switch-on      # Block all non-VPN traffic (Linux)

# Tor
pledgeshield vpn tor start
pledgeshield vpn tor route           # Route all traffic through Tor (Linux)
pledgeshield vpn tor check-ip        # Check exit IP

# Watch for new ports, root processes, firewall changes
pledgeshield monitor

# Fast polling, 60 second run
pledgeshield monitor --interval 2 --max-runtime 60

Caching: API responses cached to disk (TTL: 24h). Batch queries where supported. Offline mode uses last cached response.

SHARED MODULES (same concept, all 3 platforms)     PLATFORM-SPECIFIC (conditional compilation)
┌────────────────────────────────────┐             ┌─────────────────────────────────────┐
│ HostConfigModule                   │             │ #[cfg(windows)]                     │
│ ServicesModule                     │             │  WindowsHardeningModule             │
│ CveModule                          │             │  - UAC, SmartScreen, Defender       │
│ PrivilegesModule                   │             │  - BitLocker, Registry hardening    │
│ PersistenceModule                  │             │  - SMB shares, RDP, Credential Mgr  │
│ CredentialsModule                  │             │  - WMI, DLL hijack, Wi-Fi Sense     │
│ SharesModule                       │             │                                     │
│ PatchesModule                      │             │ #[cfg(macos)]                       │
│ BrowserModule                      │             │  MacosHardeningModule               │
│ ContainersModule                   │             │  - Gatekeeper, SIP, TCC permissions│
│ ComplianceModule                   │             │  - FileVault, Keychain audit        │
│ CustomChecks                       │             │  - XProtect, LaunchAgents/Daemons   │
└────────────────────────────────────┘             │                                     │
                                                   │ #[cfg(linux)]                       │
120+ harden modules (platform-conditional)          │  LinuxHardeningModule               │
VPN: WireGuard, OpenVPN, Tor                       │  - AppArmor / SELinux status        │
Real-time monitor                                  │  - systemd service audit            │
                                                   │  - fail2ban, /etc/ hardening        │
                                                   │  - PAM configuration                │
                                                   └─────────────────────────────────────┘

~60% shared code, ~40% platform-specific. CVE API integration is 100% platform-agnostic.

pledgeshield/
├── Cargo.toml
├── README.md               # This file
├── COMMANDS.md             # Full command reference
├── MODULES.md              # All 121 modules documented
├── .github/workflows/
│   ├── ci.yml              # CI: test + build (3 platforms, 2 toolchains)
│   └── release.yml         # Release: 8 package managers + GitHub Releases
├── apt/                    # apt repository public key
├── src/
│   ├── main.rs             # Entry point, CLI dispatch
│   ├── cli.rs              # CLI argument definitions (clap)
│   ├── config.rs           # Config file loading (TOML/YAML)
│   ├── baseline.rs         # Baseline diff scanning
│   ├── models.rs           # Finding, Severity, ScanResult models
│   ├── output.rs           # Text, JSON, HTML, SARIF, Markdown, PDF output
│   ├── monitor.rs          # Real-time security monitor
│   ├── history.rs          # SQLite scan history
│   ├── trend.rs            # Trend dashboard
│   ├── compliance.rs       # CIS / NIST compliance mapping
│   ├── custom.rs           # User-defined checks
│   ├── containers.rs       # Docker/Podman/K8s checks
│   ├── browser.rs          # Browser extension audit
│   ├── network.rs          # Network exposure checks
│   ├── modules/            # 11 scan modules
│   ├── harden/             # 120+ active defense modules
│   ├── cve/                # CVE API clients (NVD, OSV, GHSA, EPSS, cache)
│   ├── fix/                # Interactive fix actions (Windows, macOS, Linux)
│   ├── notify/             # Email + webhook notifications + scheduled scans
│   ├── vpn/                # WireGuard, OpenVPN, Tor management
│   └── platform/           # Platform-specific implementations
└── templates/
    └── report.html         # HTML report template

Key differentiators:

• Cross-platform — Windows, macOS, and Linux from a single codebase
• 120+ active defense modules — not just scanning, but hardening
• Rust — memory-safe, single binary, no runtime dependency
• API-based CVE — no local database to maintain, always current
• Multi-source CVE — NVD + OSV + GHSA with CPE matching and ecosystem detection
• EPSS scoring — prioritize by actual exploit likelihood, not just CVSS
• SARIF output — GitHub code scanning compatible for CI/CD integration
• Baseline diff — track security posture changes over time
• Posture scoring — 0-100 score with letter grade
• Hardening profiles — CIS Level 1/2, STIG, or custom
• VPN management — WireGuard, OpenVPN, Tor built in
• Real-time monitor — watch for new ports, processes, firewall changes
• 8 package managers — cargo, npm, PyPI, RubyGems, NuGet, Homebrew, winget, apt

• Language: Rust
• CLI: clap
• HTTP: reqwest (CVE API calls)
• Serialization: serde, serde_json, serde_yaml, toml
• Database: rusqlite (scan history)
• Progress: indicatif
• Windows APIs: windows crate, winreg, wmi
• macOS APIs: core-foundation, system-configuration, security-framework
• Linux APIs: procfs, nix, sysctl

# Build
cargo build --release

# Run tests
cargo test

# Run clippy
cargo clippy --all-targets -- -D warnings

# Check formatting
cargo fmt --all -- --check

CI runs on every push and PR across Ubuntu, macOS, and Windows with stable and beta Rust toolchains.

MIT — see LICENSE

mehdi-berel — mehdi.berel@pledgeandgrow.com

• GitHub Repository
• Issue Tracker
• Releases
• Full Command Reference
• Full Module List