Marshmallow Security Scan

 __  __                _                     _ _
|  \/  | __ _ _ __ ___| |__  _ __ ___   __ _| | | _____      __
| |\/| |/ _` | '__/ __| '_ \| '_ ` _ \ / _` | | |/ _ \ \ /\ / /
| |  | | (_| | |  \__ \ | | | | | | | | (_| | | | (_) \ V  V /
|_|  |_|\__,_|_|  |___/_| |_|_| |_| |_|\__,_|_|_|\___/ \_/\_/

 ____                      _ _         ____
/ ___|  ___  ___ _   _ _ __(_) |_ _   _/ ___|  ___ __ _ _ __
\___ \ / _ \/ __| | | | '__| | __| | | \___ \ / __/ _` | '_ \
 ___) |  __/ (__| |_| | |  | | |_| |_| |___) | (_| (_| | | | |
|____/ \___|\___|\__,_|_|  |_|\__|\__, |____/ \___\__,_|_| |_|
                                  |___/

Production-ready CLI security scanner for URLs and local repositories.

---

Install

pip install marshmallow-scan

---

Features

Scanner	What it checks
URL → Headers	CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, Server/X-Powered-By leakage
URL → SSL/TLS	Certificate validity, expiry (warns at 30 days, critical at 7), hostname match, HTTPS enforcement
URL → Open Redirects	Tests common redirect parameters (url, next, redirect, return, …) against an external probe
URL → Exposed Files	35+ sensitive paths: .env, .git/config, wp-config.php, id_rsa, swagger.json, and more
Dir → Secrets	AWS keys, GitHub tokens, OpenAI keys, Stripe keys, Slack tokens, database URLs, PEM private keys, hardcoded passwords
Dir → Deprecated Functions	eval(), pickle.loads(), yaml.load(), os.system(), shell=True, weak hashes (MD5/SHA-1), SSL verify=False — across Python, JS, TS, PHP, Ruby, Go, Java

Output — color-coded PASS / WARN / FAIL using Rich.
Export — --output report.json for JSON reports.
Remediation — --fix prints step-by-step guidance for every finding.

---

Usage

Scan a URL

# Basic scan
marshmallow-scan url https://example.com

# With remediation guide
marshmallow-scan url https://example.com --fix

# Export JSON report
marshmallow-scan url https://example.com --output report.json

# Skip specific checks
marshmallow-scan url https://example.com --skip-ssl --skip-redirects

# Custom timeout
marshmallow-scan url https://example.com --timeout 30

# Only show WARN and FAIL findings (hide INFO/PASS)
marshmallow-scan url https://example.com --min-severity WARN

Scan a directory / repository

# Scan current directory
marshmallow-scan dir .

# Scan a specific path
marshmallow-scan dir ./my-project

# With remediation guide
marshmallow-scan dir ./my-project --fix

# Export JSON report
marshmallow-scan dir ./my-project --output findings.json

# Skip specific checks
marshmallow-scan dir . --skip-secrets
marshmallow-scan dir . --skip-deprecated

# Only show FAIL findings (useful in CI)
marshmallow-scan dir . --min-severity FAIL

---

Sample Output

 __  __                _                     _ _
|  \/  | __ _ _ __ ___| |__  _ __ ___   __ _| | | _____      __
| |\/| |/ _` | '__/ __| '_ \| '_ ` _ \ / _` | | |/ _ \ \ /\ / /
| |  | | (_| | |  \__ \ | | | | | | | | (_| | | | (_) \ V  V /
|_|  |_|\__,_|_|  |___/_| |_|_| |_| |_|\__,_|_|_|\___/ \_/\_/

 ____                      _ _         ____
/ ___|  ___  ___ _   _ _ __(_) |_ _   _/ ___|  ___ __ _ _ __
\___ \ / _ \/ __| | | | '__| | __| | | \___ \ / __/ _` | '_ \
 ___) |  __/ (__| |_| | |  | | |_| |_| |___) | (_| (_| | | | |
|____/ \___|\___|\__,_|_|  |_|\__|\__, |____/ \___\__,_|_| |_|
                                  |___/

  Powered by Marshmallow.Projects — Cybersecurity Services

─────────────── Security Scan: https://example.com ────────────────
  Scan type: url
  Timestamp: 2026-06-07T10:23:14Z

╭────────┬──────────────────────────────┬──────────────────────────────────────────╮
│ Status │ Check                        │ Description                              │
├────────┼──────────────────────────────┼──────────────────────────────────────────┤
│  PASS  │ Header: CSP                  │ Content-Security-Policy header is present│
│        │                              │   Value: default-src 'self'              │
│  FAIL  │ Header: HSTS                 │ Strict-Transport-Security header missing │
│        │                              │   Without HSTS, browsers may connect...  │
│  WARN  │ Header: X-Frame-Options      │ X-Frame-Options header is missing        │
│  PASS  │ Header: X-Content-Type-Opt.  │ X-Content-Type-Options present           │
│  PASS  │ SSL/TLS: Certificate Validity│ SSL certificate is valid and trusted     │
│  WARN  │ SSL/TLS: Certificate Expiry  │ SSL certificate expires in 24 day(s)     │
│        │                              │   Expiry date: 2026-07-01                │
│  PASS  │ SSL/TLS: Hostname Match      │ Certificate hostname matches 'example...'│
│  INFO  │ Open Redirect                │ No common redirect parameters detected   │
│  PASS  │ Exposed Files                │ No sensitive files detected (35 checked) │
╰────────┴──────────────────────────────┴──────────────────────────────────────────╯

─────────────────────────── Summary ───────────────────────────────
  6 PASS · 2 WARN · 1 FAIL · 1 INFO  (10 checks)

  ✖ 1 critical issue(s) found. Run with --fix for remediation steps.

JSON export format (--output report.json)

{
  "target": "https://example.com",
  "scan_type": "url",
  "timestamp": "2026-06-07T10:23:14Z",
  "summary": {
    "pass": 6,
    "warn": 2,
    "fail": 1,
    "info": 1,
    "total": 10
  },
  "findings": [
    {
      "check": "Header: HSTS",
      "severity": "FAIL",
      "description": "Strict-Transport-Security (HSTS) header is missing",
      "detail": "Without HSTS, browsers may connect over plain HTTP...",
      "remediation": "Add Strict-Transport-Security: max-age=31536000; includeSubDomains; preload"
    }
  ]
}

---

Exit Codes

Code	Meaning
0	All checks passed (no FAILs)
1	One or more FAIL findings

This makes marshmallow-scan easy to integrate into CI pipelines.

---

CI Integration

# .github/workflows/security.yml
- name: Security scan
  run: |
    pip install marshmallow-scan
    marshmallow-scan url ${{ vars.STAGING_URL }} --output scan.json
    marshmallow-scan dir . --output code-scan.json

---

Development

git clone https://github.com/Marshmallow-Projects/marshmallow-security-scan.git
cd marshmallow-security-scan
python -m venv .venv && source .venv/bin/activate
pip install -e ".[dev]"
pytest

See CONTRIBUTING.md for full contribution guidelines. See ROADMAP.md for planned features and where the project is heading.

---

License

MIT © Marshmallow Projects

---

Powered by Marshmallow.Projects — Cybersecurity Services