Trilltechnician/incredigo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

quarantine: scrub tailnet ref, add license, ship lab/ repro kit, refresh README for cohort
ci / build-test (push) Has been cancelled
Details

Browse Source 
- untrack CLAUDE.md (tailnet leak) + stale HANDOFF.md; keep local via .gitignore
- add source-available LICENSE (attribution on fork, royalty on commercial use)
- add lab/ reproduction kit (fake-cred LIVE-VM/mock rotation POCs) + lab/README
- rewrite README to current status (22 drivers, 8 LIVE-VM/14 MOCK-ONLY/0 LIVE-REAL,
  247 tests) and carry the credential-handling safety rules

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
leetcrypt
2026-07-17 22:40:12 -07:00
parent 2459cd4fd8
commit ac0ff8e2af
26 changed files with 2156 additions and 236 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+108 -51
View File
@@ -21,93 +21,150 @@
Incredigo finds credentials scattered across the usual places
(`~/.aws/credentials`, `.env` files, `~/.netrc`, SSH keys,
`~/.docker/config.json`, kubeconfig, …), migrates them into a
`~/.docker/config.json`, kubeconfig, gitea/git tokens…), custodies them in a
[gopass](https://www.gopass.pw/) (GPG-backed) store **without ever writing
plaintext to disk**, and tells you which ones are stale.
plaintext to disk**, tells you which ones are stale, **rotates what's
scriptable**, and hands you a guided worklist for the rest.
- 🔒 **No plaintext at rest.** Disk only ever holds GPG blobs (gopass) or
openssl-sealed backups.
sealed backups (age / hmac / openssl).
- 🧠 **RAM-only secrets.** Decrypted material lives in `mlock`'d, non-dumpable,
zeroized memory ([memguard](https://github.com/awnumar/memguard)).
- 📴 **Offline.** v1 makes zero network calls.
- 👀 **Read-only discovery.** Scanners never touch your source files.
- 🧩 **Hackable.** A new source is one file; the backup format is an interface.
- ♻️ **Backup-gated rotation.** No rotation runs without a verified sealed backup
first; new secret is proven to authenticate before the old one is revoked.
- 🧩 **Hackable.** A new scanner, sealer, or rotation driver is one file each.
See [`DESIGN.md`](DESIGN.md) for the architecture and threat model.
See [`DESIGN.md`](DESIGN.md) for architecture + threat model,
[`VISION.md`](VISION.md) for who it's for, and [`docs/MARKET.md`](docs/MARKET.md)
for positioning.
## Why the name
## Who it's for
**Incredigo** is one word hiding three:
The **vibe coder** — the fast-moving AI-assisted builder who ships in a weekend
and accumulates dozens of credentials (`.env` keys, `sk_live`, `DATABASE_URL`,
GitHub PATs, AWS keys) each *generated once, pasted in, and never rotated*.
Incredigo finds that sprawl, custodies it, backs it up, rotates what's scriptable,
and guides the human through the rest — before a forgotten key becomes a breach.
```
in · CRED · i · GO
└┬─┘ └┬┘
CREDentials in GO
```
## Status (2026-07)
It manages your **CRED**entials, it's written in **GO**, and read aloud the whole
thing lands on *incredible* — which is the bar a credential tool that promises
"no plaintext on disk, ever" has to clear.
**v1 custody pipeline: done.** discover → RAM vault → migrate → status →
sealed export/import. 9 scanners; sealers age (default) / hmac / openssl.
### The mark
**Rotation: 22 drivers + wired Mode A `--execute` spine.** All self-register.
`rotate --execute` runs only behind `INCREDIGO_ALLOW_EXECUTE=1` **and** a
mandatory verified-backup gate, and only drivers proven against real target
software run by default.
The logo is **Strata** — nested diamonds tightening around a single bright core.
It's the whole tool in one glyph: each ring is a layer of custody (read-only
discovery → locked-memory vault → GPG/OpenSSL at rest), and the core is your
secret, held in RAM and never written out. The design is deliberately abstract and
geometric — no mascot, no metaphor to decode.
Proof status is tracked as **data** ([`internal/rotate/proofs.go`](internal/rotate/proofs.go),
mirrored in [`docs/ROTATION-PROOFS.md`](docs/ROTATION-PROOFS.md), surfaced as a
`PROOF` column in the CLI):
| What it does | How |
|---|---|
| **Finds, doesn't guess** | Real parsers per source — no blind grep, no false positives. |
| **Composes, doesn't invent** | Battle-tested GPG (via gopass) and OpenSSL; no home-rolled crypto to break. |
| **Holds, doesn't leak** | Read-only discovery, RAM-only custody, redacted audit log — plaintext never leaves the locked arena. |
| **Works, then vanishes** | No server, daemon, network, or temp files; it does its job and leaves nothing on disk. |
| Level | Count | Meaning |
|---|---|---|
| **LIVE-VM** | 8 | cutover proven against **real** target software in a sandbox VM: postgres, mysql, redis, mongo, wireguard, gitea, appsecret, k8s |
| **MOCK-ONLY** | 14 | proven only against an emulator/mock (httptest, moto): aws, sshkey, openwrt, mullvad, cloudflare, ghactions, gitlab, npm, gcp, twilio, flyio, resend, vercel, sendgrid |
| **LIVE-REAL** | 0 | **no real, host-owned credential has ever been rotated** — this remains gated behind explicit per-credential authorization |
The brand is **Incredigo**, and so is the command: the CLI was renamed from its old
working title `credrot` so the tool and the project finally share a name.
**Guided manual layer: done.** `incredigo worklist` / `incredigo guide` (TUI)
emit a secrets-free checklist of change-URLs (49 curated sites + RFC 8615).
## Status
**Phase B (password-manager / browser turnover): scaffolded, not wired.** 12
adapters + pwgen + staging exist; `passwords pw-*` flow is incomplete.
v1 scope: **discover + migrate + expiry tracking**. Provider-driven rotation
(issue-new / verify / revoke-old) is planned for v2 behind a stable interface.
`export`/`import` are stubbed in this scaffold (see `cmd/incredigo/main.go`).
> **Rename in progress:** the Go package and binary are being renamed
> `credrot` → `incredigo`. Until that lands, substitute `./cmd/credrot` /
> `credrot` in the commands below.
Tests: **247 pass, `-race` clean, 13 packages.** Coverage highlights: vault/worklist
100%, policy 95%, sink 85%, tui 88%; `cmd/incredigo` (34%) is the weakest and the
next test target.
## Build
Requires Go 1.22+.
```sh
go mod tidy
go build ./cmd/incredigo
go build ./cmd/incredigo # or: make build
go test -race ./... # 247 tests, -race clean
```
## Usage
```sh
incredigo scan --dry-run # see what's out there (no secrets printed)
incredigo migrate --prefix imported/ --dedupe
incredigo status # age vs policy
incredigo export --out ~/incredigo-backup.enc # (v1 stub)
incredigo scan --dry-run # see what's out there (no secrets printed)
incredigo migrate --prefix imported/ --dedupe # custody into gopass, no plaintext on disk
incredigo status # age vs policy
incredigo export --out ~/incredigo-backup.age # sealed backup (age)
incredigo worklist --out rotate.md # guided checklist for manual rotations
incredigo guide # TUI walk-through of the worklist
# rotation (Mode A — rotate what's already in gopass):
incredigo rotate --dry-run --prefix imported/ --blast # plan + blast radius, touches nothing
INCREDIGO_ALLOW_EXECUTE=1 incredigo rotate --execute --prefix imported/
```
`--execute` is refused unless `INCREDIGO_ALLOW_EXECUTE=1` is set; it always runs
the backup gate first, and skips any driver whose proof is below `LIVE-VM` unless
you pass `--allow-mock-proven`.
## Reproduce the LIVE-VM proofs
The 8 `LIVE-VM` claims are reproducible from a clean machine — see
[`lab/README.md`](lab/README.md). The scripts stand up **real** target software
(PostgreSQL, MariaDB, redis, mongod, wireguard, Gitea, k3s) in a throwaway VM and
rotate **fake** credentials in an **isolated** gopass store. Nothing there can
touch a real store or provider.
## Safety rules (this tool holds real credentials)
1. **Backup before rotate, always.** No rotation runs without a verified sealed
backup of the affected entries first; the gate aborts on any backup/verify failure.
2. **Verify-new-before-revoke-old.** Order is backup → rotate → verify the new
secret authenticates → store → re-read → *only then* revoke the old.
3. **No plaintext secrets on disk, ever.** Secrets live only in the memguard vault.
Browser passwords become a worklist of non-secret metadata, never a `.txt` dump.
4. **Self-owned only.** Automation targets only your own accounts, with your
authorization. It never bypasses MFA/CAPTCHA — it hands off to the human.
5. **Dry-run by default; destructive steps are opt-in, audited, reversible.**
6. **The GPG passphrase is the root of trust.** Lose it → everything is
unrecoverable; leak it → everything is exposed. Back up the GPG key; use a
strong passphrase.
## Layout
| Path | Purpose |
|---|---|
| `cmd/incredigo` | cobra CLI |
| `internal/vault` | RAM-only secret arena (memguard) |
| `cmd/incredigo` | cobra CLI: scan, migrate, status, export, import, rotate, worklist, guide, passwords |
| `internal/vault` | RAM-only secret arena (memguard: mlock / DONTDUMP / zeroize) |
| `internal/discover` | scanner registry + one file per source |
| `internal/sink` | gopass writer + Sealer interface + openssl impl |
| `internal/policy` | expiry rules |
| `internal/audit` | redacted append-only log |
| `internal/sink` | gopass writer + bundle framing + Sealer (age / hmac / openssl) |
| `internal/policy` | expiry engine |
| `internal/audit` | redacted append-only JSONL log |
| `internal/rotate` | Rotator interface + mandatory backup gate + 22 drivers + proofs-as-data |
| `internal/blast` | read-only "which files consume this credential" map |
| `internal/links` / `worklist` / `tui` | guided manual-rotation layer |
| `internal/pwstore` / `pwgen` | Phase B password-manager adapters (scaffolded) |
| `lab/` | reproducible LIVE-VM / mock rotation proofs (fake creds) |
## Documentation
- [`DESIGN.md`](DESIGN.md) — architecture + threat model
- [`VISION.md`](VISION.md) — who it's for + the mission
- [`docs/MARKET.md`](docs/MARKET.md) — competitive landscape + positioning
- [`docs/SECURITY.md`](docs/SECURITY.md) — security posture + reporting
- [`docs/ROTATION-PROOFS.md`](docs/ROTATION-PROOFS.md) — how each driver was validated
- [`docs/ROADMAP.md`](docs/ROADMAP.md) — where it's going
- [`docs/ADDING_A_SCANNER.md`](docs/ADDING_A_SCANNER.md) — contributor guide (one file per source)
## Contributing
Adding a source is intentionally easy — see
[`docs/ADDING_A_SCANNER.md`](docs/ADDING_A_SCANNER.md).
[`docs/ADDING_A_SCANNER.md`](docs/ADDING_A_SCANNER.md). New code ships with tests
(table-driven scanners; leak-checks asserting no secret substring reaches
identity/metadata/logs).
## License
Source-available under the [Incredigo Source-Available License](LICENSE):
free for personal, educational, research, and internal **non-commercial** use,
**attribution required** for any fork or redistribution, and **commercial /
monetized use requires a separate royalty-bearing license** from the author.
This is not an OSI open-source license.