I built OpenAuditKit after repeatedly running into leaked secrets and misconfigured Docker/.env files in small Python projects.

Existing tools worked well but often felt too heavy, cloud-dependent, or hard to extend.

OpenAuditKit is an offline-first, Python-native CLI tool that scans codebases for secrets and configuration risks. It uses regex + entropy checks, YAML-based community rules, and produces both human-friendly and CI-friendly reports.

It’s fully open-source and designed with a clean core that could later power an API or dashboard.

Feedback, criticism, and ideas are very welcome.

github.com/neuralforgeone/OpenAuditKit