Spectrmachina/Ztrust

What it is

ZTrust is a Python scanner for software supply-chain risk, at v0.1.0 and MIT licensed. It has five scanners, a GitHub Action, and a separate FastAPI bounty service that pays researchers in shielded Zcash. The summary names the categories. This note adds the rule IDs, commands, exit codes, config and action usage.

How it works

Rule IDs are namespaced by scanner:

• Secrets: ZT-SEC-001 (AWS key ID), ZT-SEC-002. It also covers Zcash spending keys, committed .env files and high-entropy credentials.
• Typosquat: ZT-TYPO-001, against popular npm, PyPI and crates.io names (reqeusts, crossenv, l0dash).
• Integrity: ZT-INT-007 covers install scripts and curl | sh. It also flags missing lockfile hashes, http:// and git sources, and unpinned requirements. ZT-INT-005 relates to --require-hashes.
• CI: ZT-CI-001 (unpinned actions), ZT-CI-002 (pull_request_target pwn requests), ZT-CI-003 (${{ github.event.* }} script injection), plus broad token permissions.
• Vulns: ZT-VULN-001 and ZT-MAL-001. These query OSV.dev for CVEs, GHSAs and the OpenSSF MAL- malware feed, with CVSS v3 scoring.

Supported inputs are requirements*.txt, poetry.lock, uv.lock, package-lock.json (v1 to v3), package.json, go.mod and Cargo.lock. Yarn, pnpm, Maven, NuGet and RubyGems are on the roadmap, not shipped.

The bounty flow works in four steps. The researcher commits SHA-256(salt:report) and a payout address. They later reveal the report and salt. The API verifies the hash, and the earliest commitment wins duplicates. After a maintainer accepts, the API calls z_sendmany with an encrypted memo. Pools can publish a viewing key for audit.

What to do

Try it on the bundled demo project, then on your own:

git clone https://github.com/Lostreaksmb/ztrust.git
cd ztrust
pip install -e .
ztrust scan examples/vulnerable-app
ztrust scan .

Other useful invocations:

ztrust scan . --format sarif -o ztrust.sarif
ztrust scan . --format json --offline
ztrust scan . --only secrets,ci --fail-on medium

Exit codes are 0 for clean, 1 for findings at or above --fail-on (default high), and 2 for a usage error. --offline skips the OSV lookup, so the vulns scanner has no network data in that mode.

As a CI step, grant permissions: contents: read and security-events: write, then use:

- uses: Lostreaksmb/ztrust@v0.1.0
  with:
    fail-on: high

The page recommends pinning the action to a commit SHA in production. The action passes its inputs through environment variables to avoid the script injection it detects.

Tune noise with .ztrust.yml, which supports exclude, fail_on, disable_rules (globs such as ZT-SEC-0* work), severity_overrides, allowlist_packages and secrets_allowlist. A # ztrust:ignore comment silences one line.

Caveats

• The page's clone URL and action reference use Lostreaksmb/ztrust, while the listed repo is Spectrmachina/Ztrust. Confirm which owner is canonical before pinning the action.
• The page shows no benchmarks, false-positive rates or test coverage figures.
• The bounty API uses a mock payout backend by default. Real payments need ZTRUST_ZCASH_BACKEND=rpc and a Zallet wallet on a Zebra node. The server needs pip install -e ".[server]" and ZTRUST_ADMIN_TOKEN.
• Release-tarball versus source diffing, which would catch xz-style backdoors, and Sigstore/SLSA verification are roadmap items, not present.