# Spectrmachina/Ztrust

> Zero-trust supply-chain scanner that detects malicious and vulnerable dependencies, typosquats, leaked secrets and unsafe GitHub Actions, and pays independent researchers in shielded Zcash via a commit-reveal bounty protocol.

- Magnitude: 4.9 out of 10 — Early signal
- Stars: 152 total · +0 stars measured 2026-10-23, 00:37–02:43 UTC, ≈ 118 by evening
- Star trust: star growth looks organic
- Category: Security · Language: Python · License: MIT · Created: 2026-10-22 · Last push: 2026-10-22
- GitHub: https://github.com/Spectrmachina/Ztrust · Page: https://gitnova.dev/en/r/Spectrmachina/Ztrust

## Useful for

- Run ztrust scan in CI and upload SARIF to the GitHub Security tab
- Check lockfiles and workflows for typosquats, leaked tokens and pwn requests
- Create a bounty commitment for a private vulnerability report and pay out in Zcash

## Why it’s here

- Star-counter measurements on 2026-10-23 (UTC), 00:37–02:43: 152 → 152 stars (+0). This is the change over that interval.
- Estimated end-of-day forecast: about +118 stars, using observed gains and the previous day.
- The repository is 1 day old and already has 152 stars. With less than two weeks of history, there's no usual pace to compare the spike against yet.
- Top new repositories this week: #144.

## Star trust

Star growth looks organic.

Star-trust labels are heuristics based on the repository’s behavior, not a check of every stargazer.

## Numbers

- Forks: 0
- Issues and pull requests: 0
- Watchers: 46
- Average over the last week: 135 per day
- Usual pace: too little history (under two weeks)
- Stars in the last hour (measured): 0

## Stars per day, last 2 days (oldest → newest, today is partial)

2026-10-22 … 2026-10-23: 152, 0

## Spotted in now

- Top new repositories this week: #144

## Similar by description

1. **gitleaks/gitleaks** — 2.2 · Steady · Security · Go · +1 star measured 2026-10-23, 00:39–02:47 UTC, ≈ 29 by evening
   Gitleaks is a Go tool that detects hardcoded secrets like passwords, API keys, and tokens in git repos, files, directories, and stdin. It is aimed at developers and DevSecOps engineers to prevent credential leaks via commits.
   Full card: https://gitnova.dev/en/r/gitleaks/gitleaks.md

---

Magnitude (0–10) measures how fast and how unusually interest in a repository is growing right now. It is not a quality score.
Days are UTC. “So far today” is a fact; “expected by the end of the day” is a forecast.
Summaries and use cases are written by an LLM (DeepSeek V4.1 Flash) from the README and may be inaccurate: verify specific claims (benchmarks, speed, hardware) in the repository itself.
Data as of 2026-10-23 02:53 UTC, updated every 30 minutes.