PledgeShield
Personal device security auditor for Windows, macOS, and Linux — finds what antivirus misses.
What It Is
PledgeShield is a Rust-based host security auditor. It scans your device for misconfigurations, exposed services, unpatched software, privilege escalation vectors, and other attack surfaces that antivirus software doesn't look at.
Think lynis — but cross-platform, in Rust, one binary, no agent, no server.
Install
gem install pledgeshield
Quick Start
# Run a full security audit
pledgeshield scan
# Scan with CVE checking and compliance mapping
pledgeshield scan --cve --compliance --format html --output report.html
# Harden your system (120+ hardening modules)
pledgeshield harden firewall --harden --allow-ssh
pledgeshield harden ports --all
pledgeshield harden doh --enable cloudflare
pledgeshield harden sysctl --harden
pledgeshield harden ssh --harden
# Real-time monitoring
pledgeshield monitor
# Check your security posture score
pledgeshield harden posture
What It Detects
- Exposed services and open ports (RDP, SSH, Telnet, FTP)
- Unpatched CVEs in installed software
- Weak SSH configs, password auth, root login
- Suspicious scheduled tasks, cron jobs, systemd timers
- World-readable sensitive files (SSH keys, credentials, configs)
- Missing disk encryption
- Disabled firewall, UAC, Gatekeeper, AppArmor
- Rootkit indicators, process injection, hollow processes
- Ransomware canary files
- Data exfiltration patterns
- And 80+ more checks
Active Defense (120+ Modules)
| Category | Examples |
|---|---|
| Network | Firewall, DNS-over-HTTPS, ARP detector, rate limiter, geo-IP filter |
| Privacy | MAC spoofer, telemetry blocker, clipboard guard, metadata stripper |
| Detection | Rootkit scanner, ransomware canary, intrusion detector, log tampering |
| Hardening | Sysctl, SSH, SUID scanner, immutable files, mount options |
| Boot | UEFI/Secure Boot audit, boot log analyzer, TPM checker |
| Hardware | Thunderbolt guard, webcam guard, microphone mute, FireWire DMA block |
Platforms
| OS | Support |
|---|---|
| Linux | Full (x86_64, aarch64) |
| macOS | Full (Intel, Apple Silicon) |
| Windows | Full (x86_64) |
License
MIT