Titus by Praetorian

What it is

Titus (Praetorian) usage specifics not in the catalog summary: the subcommand layout, no-token public scanning, the container auth model, and the git-history/deleted-layer recovery behavior.

How it works

Functionality splits into focused subcommands beyond scan: analyze (detect type, validate, score, and enumerate resources for a single credential on demand), enum (enumerate remote services), explore (interactive results), report, rules, and serve (streaming server for the Burp extension). Risk scores are 0–100 across info→critical tiers, tuned by static rule metadata, code-accessibility context, and live API calls measuring real blast radius.

Container scanning needs no Docker daemon or binary — Titus pulls from any OCI registry over HTTPS, or reads a docker save tarball or OCI layout directory. It scans manifest/config metadata and every regular file in every layer, including lower-layer files deleted by later layers, since those remain recoverable from image history. Git-history scanning likewise surfaces secrets from past/deleted commits.

Preconditions / Affected

• Public GitHub/GitLab repos scan by URL with no token. GITHUB_TOKEN/GITLAB_TOKEN (or --token) unlock private repos and higher rate limits.
• Registry auth reuses existing ~/.docker/config.json / ${XDG_RUNTIME_DIR}/containers/auth.json. Titus does not prompt for credentials — private registries must be authenticated first via docker login, podman login, or crane auth login.
• Hyperscan/Vectorscan acceleration is used when available; a pure-Go fallback runs on any platform.

What to do

# Scan git history for secrets in past (deleted) commits
titus scan --git path/to/repo

# Pull and scan a container image — no docker daemon required
titus scan --docker alpine:latest
titus scan --docker ./my-app.tar
titus scan --docker ./img/

# Validate detected secrets against source APIs
titus scan path/to/code --validate

# Org/user-wide scanning
titus github --org kubernetes --token $GITHUB_TOKEN
titus github --user octocat
titus gitlab scan --group mygroup --token $GITLAB_TOKEN

# Analyze one credential: detect, validate, score, enumerate
titus analyze

Results write to a datastore (titus.ds by default); re-read with titus report or titus report --format json.

Caveats

• The older top-level titus <provider> forms still work but are hidden and deprecated (not aliases); they appear only in the generated docs/CLI.md reference, not in --help.
• Live validation reduces false positives but requires outbound API calls to the credential's source service.