Security checks

Check a Merkle inclusion proof, scan for signatures you supply and review repository practices from supplied files. These bounded checks do not establish that a file or repository is safe.

3 tools in this category.

• Transparency log inclusion proof

  Checks whether an entry belongs to a transparency log Merkle tree by the RFC 6962 rule: node = SHA-256(0x01 ‖ left ‖ right), leaf = SHA-256(0x00 ‖ data). You bring the leaf hash, the index, the tree size, the audit path hashes and the claimed root, and the tool rebuilds the root bottom-up with the even/odd node rule and compares it with the claimed one. It shows a table of steps with the left and right hash, the step count, and the computed and claimed root. SHA-256 is implemented in its own code without crypto.subtle.

• Local signature scan of a file

  Searches the file for the exact patterns you provide as lines "name ; type ; pattern". Type hash is the SHA-256 of the whole file, type hex is a byte sequence where "??" means any byte, and type string is an ASCII substring. For every match it shows the signature name, the type, the byte offset from the start of the file and a content fragment, then gives a verdict of infected or clean plus counters of checked signatures and bytes. The SHA-256 used for type hash is implemented in its own code.

• Repository security practice score

  Scores security practices from the file list and content you provide, following the OpenSSF Scorecard idea: security policy, license, continuous integration, branch protection, dependency update tool, pinned versions in package.json, CODEOWNERS, README, and a dangerous pull_request_target trigger in workflows. Every check gets a 0–10 score with a reason and evidence, checks without data are marked not applicable, and the overall score is the mean of the scored checks.