SecureXcel firewall configuration review -- offline tool
=======================================================

One file. No installer, no dependencies, no network access. Requires Python
3.10 or later, which ships with current Linux and macOS.

Two ways to run it.

DOUBLE-CLICK
    macOS    "Run review (macOS).command"
    Windows  "Run review (Windows).bat"
  It asks you to drag in the configuration file, writes a PDF beside it and
  opens it.

  FIRST RUN ON macOS. The file is downloaded and unsigned, so Gatekeeper
  blocks it. On macOS 15 and later there is no "Open Anyway" in that dialog
  and right-clicking no longer helps. Either:

    a) Open Terminal and paste this, pointing at the unzipped folder:
           xattr -dr com.apple.quarantine "/path/to/securexcel-review-macos"
       Then double-click normally.

    b) Double-click once and dismiss the warning, then open
       System Settings -> Privacy & Security, scroll to Security, and press
       "Open Anyway" next to the blocked file.

  Both are one-time. Signing the launcher would remove the step entirely but
  requires an Apple Developer account; this build is unsigned and we would
  rather say so than have you click past a security warning without reading it.

COMMAND LINE
    python3 securexcel-review.pyz <config-backup> --format html

Supported: FortiOS, Cisco ASA, Cisco IOS/IOS-XE, Palo Alto PAN-OS,
Juniper SRX (display set), MikroTik RouterOS, pfSense/OPNsense,
Linux iptables and AWS security group exports. The vendor is detected
automatically; --vendor overrides it.

Formats: html, pdf, json, text, bundle.

Your configuration is read on this machine and is never transmitted. The report
contains no configuration text -- findings describe matched policy only, such as
"policy 3 permits any to any on any service".

To have the findings countersigned, produce a bundle:

    python3 securexcel-review.pyz <config-backup> --format bundle

The bundle holds the findings and a hash of the configuration. It contains no
configuration text, so it can be sent for review without the backup leaving
your control. Add --anonymise to withhold the device and rule names as well.

Exit codes: 0 clean, 1 findings at or above --fail-on (default: high),
2 an error.
