hbs-tool.PotenFYR Studios · configuration security
Offline-first host baseline security reviews
HBS pairs a strictly read-only Rust extractor with a sealed-report dashboard: 368 hardening testcases across Linux and Windows, sealed .hbs reports only the issuing dashboard can decrypt, and executive-to-evidence consoles.
368
hardening testcases
2
platforms: Linux + Windows
0
bytes written except the report
HBS2
sealed report envelope
Two commands, whole fleet
Issue. Scan. Seal. Review.
The dashboard patches a per-issuance X25519 public key into the extractor keyslot. On the target, the extractor scans unprivileged and writes one sealed report beside itself. Upload it - or let --push deliver it. Everything else is automatic.
target host (offline, unprivileged)
# run the issued extractor on the target - no network
./hbs-extractor --no-elevate --quiet
# hbs-report-*.hbs appears beside the binary: the only
# file the tool ever writes. Deliver it by USB drop,
# dashboard upload, or optional --push.Why HBS
Built like evidence, not like a scanner
Sealed reports
Every scan produces a single .hbs file - an AEAD envelope (X25519 + ChaCha20-Poly1305/AES-256-GCM) that only the issuing dashboard can decrypt. The entire header is authenticated as AAD.
Strictly read-only
Only allowlisted query commands run; state-changing or network-capable probes are rejected before spawn. DNS/remote forms are refused. The one write on the target is the sealed report.
Air-gapped by default
The extractor touches no network unless you explicitly pass --push. Reports travel by USB drop or dashboard upload - the dashboard derives campaign and location from the issuance alone.
Every audience served
Executive one-pager for leadership, copyable remediation for sysadmins, pivots + evidence diffing for analysts, board-ready printable exports for management.
Bounded and honest
Peak RSS < 200 MB, < 10 MB binary, exactly one disk write. Checks degrade to DegradedPartial with missingData - never false-pass, never silent Error.
Validated for real
13-distro Linux sweep with --network none, Windows Server Core LTSC 2019/2022/2025 containers, native Windows matrices, cross-language crypto vectors.
Four audiences, one console
Security leadership
Executive one-pager, risk gauge, plain-language narrative, presentation mode.
System administrators
Actionable remediation grouped into action items with copyable fix commands.
Cyber analysts
Pivots, evidence blocks, host/report diffing, telemetry percentiles.
Upper management
Board-ready reporting and printable deliverables (PDF, Excel, Word).
Ready to run your first sealed scan?
The dashboard runs on your machine; the extractor runs on theirs - and never phones home.