PledgeShield

Personal device security auditor for Windows, macOS, and Linux — finds what antivirus misses.

What It Is

PledgeShield is a Rust-based host security auditor. It scans your device for misconfigurations, exposed services, unpatched software, privilege escalation vectors, and other attack surfaces that antivirus software doesn't look at.

Think lynis — but cross-platform, in Rust, one binary, no agent, no server.

Install

npm install -g pledgeshield

Quick Start

# Run a full security audit
pledgeshield scan

# Scan with CVE checking and compliance mapping
pledgeshield scan --cve --compliance --format html --output report.html

# Harden your system (120+ hardening modules)
pledgeshield harden firewall --harden --allow-ssh
pledgeshield harden ports --all
pledgeshield harden doh --enable cloudflare
pledgeshield harden sysctl --harden
pledgeshield harden ssh --harden

# Real-time monitoring
pledgeshield monitor

# Check your security posture score
pledgeshield harden posture

What It Detects

• Exposed services and open ports (RDP, SSH, Telnet, FTP)
• Unpatched CVEs in installed software
• Weak SSH configs, password auth, root login
• Suspicious scheduled tasks, cron jobs, systemd timers
• World-readable sensitive files (SSH keys, credentials, configs)
• Missing disk encryption
• Disabled firewall, UAC, Gatekeeper, AppArmor
• Rootkit indicators, process injection, hollow processes
• Ransomware canary files
• Data exfiltration patterns
• And 80+ more checks

Active Defense (120+ Modules)

| Category | Examples | |----------|---------| | Network | Firewall, DNS-over-HTTPS, ARP detector, rate limiter, geo-IP filter | | Privacy | MAC spoofer, telemetry blocker, clipboard guard, metadata stripper | | Detection | Rootkit scanner, ransomware canary, intrusion detector, log tampering | | Hardening | Sysctl, SSH, SUID scanner, immutable files, mount options | | Boot | UEFI/Secure Boot audit, boot log analyzer, TPM checker | | Hardware | Thunderbolt guard, webcam guard, microphone mute, FireWire DMA block |

Platforms

| OS | Support | |-----|---------| | Linux | Full (x86_64, aarch64) | | macOS | Full (Intel, Apple Silicon) | | Windows | Full (x86_64) |

License

MIT