gcsspectre

gcsspectre — GCS bucket auditor for drift and misconfigurations. Part of SpectreHub.

What it is

• Scan mode cross-references GCS bucket refs in code against live GCP state
• Discover mode inspects all buckets in a project for lifecycle, public access, and versioning issues
• Detects missing buckets, stale prefixes, and compliance gaps
• Produces deterministic output for CI/CD gating
• Outputs text, JSON, SARIF, and SpectreHub formats

What it is NOT

• Not a replacement for Security Command Center — not real-time
• Not a data scanner — never reads object contents, only metadata
• Not a remediation tool — reports only, never modifies buckets
• Not a cost calculator — identifies waste, does not estimate dollars

Quick start

Homebrew

brew tap ppiankov/tap
brew install gcsspectre

From source

git clone https://github.com/ppiankov/gcsspectre.git
cd gcsspectre
make build

Usage

gcsspectre discover --project my-project --format json

CLI commands

Command	Description
gcsspectre scan	Cross-reference code bucket refs against live GCS state
gcsspectre discover	Inspect all GCS buckets in a project
gcsspectre version	Print version

SpectreHub integration

gcsspectre feeds GCS bucket findings into SpectreHub for unified visibility across your infrastructure.

spectrehub collect --tool gcsspectre

Safety

gcsspectre operates in read-only mode. It inspects and reports — never modifies, deletes, or alters your buckets.

Documentation

Document	Contents
CLI Reference	Full command reference, flags, and configuration

License

MIT — see LICENSE.

---

Built by Obsta Labs