Memory-Mapped Throughput
Traverses thousands files at multi-MiB/s speeds using zero-copy memory mapping and multi-core worker pools.
Local-first security auditor
Keep leaked keys and bad packages out of git.
Rustywoof checks your code for hardcoded credentials and checks your lockfiles against the OSV database. Everything runs locally on your machine with no telemetry.
$cargo install rustywoofRustywoof is a local secret scanner and dependency auditor for developers. It scans your files for leaked keys at multi-MiB/s, checks your lockfiles against OSV, and runs your git hooks and CI checks from one binary.
Secret scanning · woof scan & check
Catch leaked keys before you push.
Instead of running dozens of slow regular expressions over every line, Rustywoof looks for known token prefixes first, checks the matching slice with a linear-time regex, and measures character randomness so dummy strings do not trigger false alarms.
Every secret found in your files is masked with asterisks in the terminal output, and woof check returns exit code 1 so your CI build stops immediately.
How scanning worksimport { createClient } from "./client"; // Hardcoded token committed by mistakeexport const GITHUB_PAT = "ghp_0th1sI54n3X4MPL3F0rAg1th4BPAt0k3nK3y";export const api = createClient({ token: GITHUB_PAT });
Scanwoof scan src/auth.ts
[INFO] Indexing repository...Scanning ├── [████████████] 100% | 577.58 MiB @ 238.51 MiB/s | 21,341 files[INFO] Sweep complete. Analyzed 21,341 files in 2.42s.[CRITICAL] Secret scan failed! Found 1 exposed secret.× [CRITICAL] Secret Detected: GitHub Personal Access Token╭─[./src/auth.ts:4:27]4 │ export const GITHUB_PAT = ****************************************;· ╰── Exposure found here╰────
Speed · memory-mapped files
238.51 MiB/s across 21,000 files.
If a pre-commit hook takes ten seconds, people bypass it. Rustywoof maps files directly from disk into memory and splits the work across all CPU cores, scanning a 577 MiB repository in 2.42 seconds.
Fast enough to run on every git commit without slowing down your workflow, and light enough to run on small CI containers.
Read the conceptsBenchmarkwoof check . --json
[INFO] Sweep complete. Analyzed 21,341 files in 2.42s.{"status":"failure","files_scanned":21341,"threats":1}
Dependency auditing · audit · sniff · remediate
Find vulnerable packages and see what pulled them in.
Rustywoof reads exact package versions from Cargo.lock, package-lock.json, pnpm-lock.yaml, yarn.lock, uv.lock, and poetry.lock, then checks them against the OSV advisory database.
When a sub-dependency is flagged, run woof sniff to see the exact parent package that brought it into your project, and woof remediate to bump it to a patched version.
Supply chain guideAuditLockfile audit & remediation
$ woof audit --prod --audit-level high[INFO] Extracted 190 dependencies across 3 ecosystems.✓ Audit complete in 1.74s. Zero vulnerabilities detected. $ woof remediate lodash 4.17.21✓ Remediation successful.
TraceDependency graph walker
$ woof sniff djangoDependency trace for django:django@6.1.1├── code@0.1.0 (devDependencies)├── server@0.1.0 (dependencies)Found 1 version of django
Privacy · local execution
Your code never leaves your machine.
The only network call Rustywoof ever makes is a batch lookup to api.osv.dev containing package names and version numbers. File paths, environment variables, and source code stay on your disk.
Edit the package name or version in the inspector to see the exact JSON body sent during an audit.
Try the playgroundLocal OSV Batch Query
woof audit reads package names and versions from Cargo.lock. Source files and local paths stay on your machine.{ "queries": [ { "version": "1.4.1", "package": { "name": "hyper", "ecosystem": "crates.io" } } ]}Configuration · .woof.toml
One config file shared across laptops and CI.
Rustywoof runs out of the box without configuration. When you need to ignore test fixtures, adjust entropy sensitivity, or add rules for internal company tokens, run woof init to generate a .woof.toml file at the root of your repo.
Committing .woof.toml keeps pre-commit hooks and CI checks on the exact same rules.
Configuration guide.woof.tomlwoof init
[core]excludes = ["node_modules/", "target/", ".venv/"]threads = 0 # auto-detect CPU cores [scanner]entropy_threshold = 4.5max_file_size_mb = 15 [audit]fail_on = "high" [[rules]]id = "corp-internal-api-key"prefix = "acme_live_"pattern = "^acme_live_[a-zA-Z0-9]{32}$"
Multi-Ecosystem Lockfiles
Audits and traces dependency trees natively across Rust (Cargo), TypeScript/Node (npm/pnpm/bun), and Python (PyPI/uv).
Deep Dependency Graph Sniffing
Walks lockfile graphs via woof sniff <package> to expose the exact transitive chain that introduced a vulnerable package.
Strict CI/CD Gatekeeping
woof check executes in milliseconds and emits structured JSON with exit code 1 to halt compromised builds.
Git Pre-Commit Hooks
woof hook install intercepts hardcoded tokens and private keys before git commit ever records them.
Redacted & Privacy-First
Secrets are automatically masked in terminal diagnostics, and OSV queries never transmit source code or file paths.
Keep secrets and vulnerable packages out of your repo.
Install in seconds, scan in milliseconds, and block leaks before they are committed.