Spectrmachina / Ztrust

### Zero-trust software supply-chain security — with shielded Zcash bounties for the people who defend open source
**Quick start** · **How it works** · **Bounties** · **Rules** · **API**
---
## 💡 The idea
Modern software is mostly other people's code. A single poisoned package, a mutable GitHub Action
tag or a leaked publish token is enough to compromise thousands of downstream projects —
**xz-utils**, **tj-actions/changed-files**, **event-stream** and a steady stream of npm/PyPI malware
have all shown it.
**ZTrust does two things:**
| | |
|---|---|
| 🛡️ **Detects** | A fast, dependency-light scanner for vulnerable and **malicious** dependencies, typosquats, leaked secrets, unsafe lockfiles and dangerous CI workflows. Runs locally, in CI, and reports straight into GitHub's Security tab. |
| 💰 **Pays defenders** | Scanners only find *known* problems. Backdoors are found by **people**. ZTrust lets maintainers fund bounty pools and pay independent researchers in **shielded Zcash** — private, borderless, without KYC — using a commit-reveal protocol that makes findings impossible to steal. |
> **Zero trust** applies to code *and* to money: every dependency is suspect until verified, and
> every payment is verifiable without exposing the people behind it.
---
## 🧭 How it works
 [code] 
More diagrams: architecture · bounty protocol · Zcash integration
---
## ✨ Features
| Scanner | What it catches | Example rule |
|---|---|---|
| 🔑 **secrets** | GitHub/GitLab/npm/PyPI/AWS/Stripe/Slack/Google/OpenAI/Anthropic tokens, private keys, **Zcash spending keys**, committed `.env`, high-entropy credentials | `ZT-SEC-002` |
| 🎭 **typosquat** | `reqeusts`, `crossenv`, `l0dash` — look-alikes of popular npm / PyPI / crates.io packages | `ZT-TYPO-001` |
| 🔗 **integrity** | Missing lockfile hashes, `http://` and git sources, unpinned requirements, install scripts, `curl \| sh` | `ZT-INT-007` |
| ⚙️ **ci** | Unpinned actions, `pull_request_target` pwn requests, `${{ github.event.* }}` script injection, broad token permissions | `ZT-CI-002` |
| 🧬 **vulns** | Known CVEs/GHSAs and **known malware** (OpenSSF `MAL-` feed) via OSV.dev, CVSS v3 scoring | `ZT-MAL-001` |
**Ecosystems:** `requirements*.txt` · `poetry.lock` · `uv.lock` · `package-lock.json` (v1–v3) · `package.json` · `go.mod` · `Cargo.lock`
**Outputs:** rich terminal report · JSON · **SARIF 2.1.0** (GitHub code scanning, with `security-severity`)
**Zcash toolkit (pure Python):** Bech32/Bech32m & Base58Check address validation, Unified Addresses (ZIP-316), payment URIs (ZIP-321), `z_sendmany` payouts via zcashd-compatible JSON-RPC / Zallet.
---
## 🚀 Quick start
 [code] 
 [code] 
### Useful commands
| Command | Purpose |
|---|---|
| `ztrust scan . --format sarif -o ztrust.sarif` | SARIF for code scanning |
| `ztrust scan . --format json --offline` | JSON, no network |
| `ztrust scan . --only secrets,ci --fail-on medium` | Subset of scanners, stricter gate |
| `ztrust deps .` | Print the dependency inventory |
| `ztru