A command-line database auditing and vulnerability scanner for PostgreSQL and MySQL.

Connects to a live database and checks for common security misconfigurations — weak permissions, unencrypted sensitive columns, missing SSL, and more.

git clone https://github.com/AtiliaZdean/dbaudit.git
cd dbaudit
python -m venv venv
venv\Scripts\activate
pip install -e .

# Basic scan (prompts for password)
dbaudit scan --host localhost --db mydb --user postgres --db-type postgres

# Save HTML report
dbaudit scan --host localhost --db mydb --user postgres --db-type postgres --output report.html

# Save JSON report
dbaudit scan --host localhost --db mydb --user postgres --db-type postgres --output report.json

# MySQL
dbaudit scan --host localhost --db mydb --user root --db-type mysql

dbaudit/
  dbaudit/
    cli.py              - Entry point and CLI definition
    connector.py        - Database connection layer
    models.py           - Shared data structures (Finding, Severity)
    reporter.py         - Terminal, JSON, and HTML output
    checks/
      users.py          - User and account checks
      permissions.py    - Privilege checks
      config.py         - Configuration checks
      columns.py        - Sensitive column scanner
  .github/
    workflows/
      ci.yml            - GitHub Actions CI
  pyproject.toml
  .env.example
  README.md

• Add --fix flag to auto-remediate safe misconfigurations (e.g. revoke public schema access)
• MongoDB and MSSQL support
• CVE lookup — cross-reference DB version against known vulnerabilities
• Scheduled scans with email/Slack alerting
• Baseline diffing — compare two scan results to detect new issues over time
• Package to PyPI so users can install with pip install dbaudit

Atilia Zainuddin

• GitHub: @AtiliaZdean