Metadata-Version: 2.4
Name: tfgaurd-engine
Version: 1.0.4
Summary: Secure, local-first Terraform security scanner with Cloud reporting.
Home-page: https://tfgaurd.com
Author: TFGaurd Team
Author-email: support@tfgaurd.com
Classifier: Programming Language :: Python :: 3
Classifier: License :: OSI Approved :: MIT License
Classifier: Operating System :: OS Independent
Classifier: Topic :: Security
Classifier: Intended Audience :: Developers
Requires-Python: >=3.8
Description-Content-Type: text/markdown
Requires-Dist: python-hcl2>=4.3.0
Requires-Dist: requests>=2.31.0
Requires-Dist: cryptography>=41.0.0
Dynamic: author
Dynamic: author-email
Dynamic: classifier
Dynamic: description
Dynamic: description-content-type
Dynamic: home-page
Dynamic: requires-dist
Dynamic: requires-python
Dynamic: summary

# TFGaurd 🛡️

**The Terraform Security Scanner that Respects Your Code.**

TFGaurd is a **Privacy-First, Local-First** security engine for Terraform. Unlike traditional SaaS scanners, TFGaurd ensures your sensitive Infrastructure-as-Code (HCL) **never leaves your machine or CI/CD runner**. 

By running the core engine locally and syncing only high-level metadata (violation counts) to your cloud dashboard, you get enterprise-grade security observability with **zero privacy trade-offs**.

---

## 🚀 Quick Start (1-Minute)

### 1. Install via Pip
TFGaurd requires Python 3.8+ and installs as a standalone CLI.
```bash
pip install tfgaurd-engine
```

### 2. Run an Anonymous Local Scan
Scan your current directory immediately. This uses our free-tier AWS security engine (112+ rules). No account or data-sync required.
```bash
tfgaurd scan .
```

### 3. Unlock 1,200+ Premium Rules (GCP, Azure, OCI)
Provide your API key to download the **Secure In-Memory Rule Bundle** (~700+ proprietary rules) and sync metadata to your [TFGaurd Dashboard](https://tfgaurd.com).
```bash
export TFGAURD_API_KEY="your_key_here"
tfgaurd scan .
```

---

## 🔒 Our Privacy Guarantee

1. **Local-Only Parsing**: Your raw HCL code is parsed and analysed on your local machine. We never see your variable values, architecture, or credentials.
2. **Metadata-Only Ingestion**: Cloud sync is strictly limited to high-level results (e.g., "3 CRITICAL violations found"). 
3. **Secure In-Memory Rule Streaming**: Premium rules are delivered as an encrypted blob that is decrypted in RAM and executed in an isolated namespace. **Rule logic is never written to disk.**

---

## 🔄 CI/CD Integration

Integrate TFGaurd into your automated pipelines in seconds.

### GitHub Actions Example
```yaml
name: Security Scan
on: [push]
jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: pip install tfgaurd-engine
      - run: tfgaurd scan . --fail-on CRITICAL
        env:
          TFGAURD_API_KEY: ${{ secrets.TFGAURD_API_KEY }}
```

---

## ✨ Features

- **1,200+ Security Rules**: Comprehensive coverage for AWS, Azure, GCP, and OCI.
- **Portability**: A 50KB zero-dependency CLI that runs anywhere (Laptop, CI/CD, Air-gapped VPCs).
- **Sub-Second Performance**: Instant security feedback for small to medium environments.
- **Metadata Sync**: Track your security posture trends on [tfgaurd.com](https://tfgaurd.com) without exposing source code.

---

## 📜 License
TFGaurd is licensed under the MIT License. See [LICENSE](LICENSE) for details.

---

**Built with ❤️ by the TFGaurd Team.**
[View Project Website](https://tfgaurd.com) | [Read Documentation](https://tfgaurd.com/docs)
