Security audit
Security checks for vulnerabilities and agentic risk
HashGen is a straightforward local hashing utility, with a caution that text passed to it may be shown in terminal output or shell history.
Install only if you are comfortable with a local shell-based hashing helper. Do not pass passwords, API keys, tokens, or other secrets as command-line text, especially with `hashgen all`, because the input or digests may appear in terminal output, logs, shell history, or process listings.
The all command prints the raw input text back to stdout (echo "Input: \"$text\""). If users hash secrets such as passwords, tokens, or API keys, the script defeats the purpose of discreet handling by exposing the plaintext in terminal history, logs, CI output, or shared session captures. In a hashing utility, users may reasonably expect only digests to be displayed.
The verify command prints both the computed and expected hash values during verification. While it does not print the plaintext directly, it still discloses sensitive verification material to stdout, which may be captured in logs or terminals; moreover, the command is designed to accept potentially secret text input as an argument, which is already exposed via shell history/process listings. In the context of an integrity/hash tool, this behavior increases accidental secret leakage risk rather than serving a security need.
No suspicious patterns detected.
