BackupGuard

Overview

Verify backup age, expected files, hashes, archives, and retention health without destructive actions.

BackupGuard is part of the X3roxDev Security & DevSecOps Toolkit. It is designed as a defensive, read-only-first open-source project for systems you own or are authorized to test.

Demo

BackupGuard demo output is available in examples/example-output.txt.

Features

• Directory registration
• SHA256 validation
• Archive checks
• Backup age alerts
• JSON history

Architecture

The project separates configuration, collection, analysis, reporting, and notifications. Scanners return structured findings with severity, evidence, and remediation text, while output adapters render terminal, JSON, CSV, HTML, or SARIF formats where relevant.

Installation

Clone the repository and install the stack-specific dependencies shown below.

git clone https://github.com/x3roxdev/backupguard.git
cd backupguard

Quick Start

go run ./cmd/backupguard --help

Configuration

Copy .env.example when environment values are needed. Runtime settings can be supplied with --config config.example.yaml where the CLI supports it. Defaults are conservative and avoid destructive remediation.

Commands

• backupguard add /backups
• backupguard verify
• backupguard status
• backupguard history

Example Output

BackupGuard

Overall Score: 84/100

HIGH    1
MEDIUM  2
LOW     3
PASS    8

Top Finding:
Severity: HIGH
Evidence: Example defensive finding generated from local checks.
Recommendation: Review the documented hardening guidance before making changes.

Export Formats

Supported formats are documented per command. Most scanners support terminal and JSON output; report-oriented tools also include CSV, HTML, or SARIF exports.

Testing

Run the language-specific test command from the repository root. CI runs the same checks on pull requests.

Docker

Where included, Docker files run the service with non-secret configuration from environment variables. Never bake tokens into images.

Security Considerations

This is a defensive tool. It does not include destructive exploitation features, does not log secrets, and masks sensitive findings where applicable. Only run scans against systems and repositories you own or are authorized to assess.

Roadmap

• Add richer provider integrations.
• Expand report templates.
• Add signed release artifacts.
• Publish package-manager installers.