Bulwark

About

Bulwark scans a Linux host for security misconfigurations and intrusion indicators using a native Rust rule engine over declarative YAML rules, and explains findings in plain language with a suggested fix. Bulwark checks: - System configuration — SSH, sudo, kernel parameters, cron, file permissions - Persistence and intrusion indicators, including promiscuous network interfaces - File integrity against a recorded baseline - AI coding assistants, for API keys leaked into transcripts and for agent configuration a prompt injection could turn into code execution - Viruses and malware, using ClamAV when it is installed Findings are sorted by how much they matter, and many come with a reversible fix that previews its changes before applying them — tightened file permissions, hardened SSH settings, redacted secrets — each shown as a preview first, so you decide before anything changes. Bulwark keeps watching after the first scan. It re-runs its checks on a timer, notices when a watched file changes, and tells you only when something genuinely new appears rather than repeating what you have already seen. A history view shows how the machine's posture has moved over time. Everything runs locally. The scanning engine makes no network calls and sends no telemetry; findings stay in a database on your own machine. Notes for this Flatpak build: Bulwark reads the host read-only to audit it, and never writes to host configuration on its own. Virus scanning uses the ClamAV already installed on your system, so signatures stay whatever your distribution keeps current. Checks that need administrator access run on the host and require the Bulwark command-line tool to be installed there as well; without it, every check that does not need root still works.