SecureXcel source code review -- offline tool
=============================================

One file. No installer, no dependencies, no network access. Requires Python
3.9 or later. macOS includes it once the Command Line Tools are installed, and
current Linux distributions ship it.

Your code is read on this machine and is never transmitted. The report lists
file paths and line numbers and the short label a rule attaches (for example the
kind of key found). It never quotes the code that matched. Nothing in the
project is run, built or installed.

Two ways to run it.

DOUBLE-CLICK
    macOS    "Run code review (macOS).command"
    Windows  "Run code review (Windows).bat"
  It asks you to drag in the project folder, writes an HTML report beside the
  folder (never inside it) and opens it.

  FIRST RUN ON macOS. The file is downloaded and unsigned, so Gatekeeper blocks
  it. Either:

    a) Open Terminal and paste this, pointing at the unzipped folder:
           xattr -dr com.apple.quarantine "/path/to/securexcel-code-review-macos"
       Then double-click normally.

    b) Double-click once and dismiss the warning, then open
       System Settings -> Privacy & Security, scroll to Security, and press
       "Open Anyway" next to the blocked file.

  This build is unsigned and we would rather say so than have you click past a
  security warning without reading it.

COMMAND LINE
    python3 securexcel-code-review.pyz <project-folder-or-archive> --format html

Formats: html, text, json, sarif. SARIF is read by GitHub code scanning and most
CI tools, so a build can fail on findings:

    python3 securexcel-code-review.pyz . --format sarif --fail-on high

To see every rule the tool applies:

    python3 securexcel-code-review.pyz --rules

What it looks for: secrets and keys committed to source, dangerous constructs
(command and SQL injection, unsafe deserialisation, weak cryptography, cross-site
scripting sinks, dynamic code evaluation) and risky infrastructure code
(Terraform, Kubernetes, Dockerfiles, CI workflows), plus how dependencies are
declared.

What it does not do: it is a pattern-based review. It does not build or run the
code or trace data through it, so it cannot find logic flaws or broken access
control, and it does not match dependency versions against vulnerability
databases. A clean report is not a security assessment.

Folders: links are never followed, and vendored folders (node_modules, vendor,
virtual environments, build output) are counted and skipped. Archives: zip, tar
and tar.gz, up to 25 MB; for anything larger, point it at the folder.

Exit codes: 0 clean, 1 findings at or above --fail-on (default: high),
2 an error.
