homelab-audit
Point it at a docker-compose file and it lists the usual mistakes, like a database open on 0.0.0.0 or a password pasted straight into the file.
$ homelab-audit docker-compose.yml[HIGH] db PostgreSQL port 5432 is published to all interfaces (0.0.0.0)[HIGH] db Hardcoded secret in environment: POSTGRES_PASSWORD ...3 high, 1 medium, 1 low
Most homelab security problems are the same few defaults copied from someone else's compose file, so those are what it looks for.
It only reads the file. No Docker needed, no network. It runs on Node 24 without a build step.
Try it
$ git clone https://github.com/LeelaKrishna-R/homelab-audit && cd homelab-audit$ npm install$ npm run audit fixtures/insecure.yml
2026TypeScriptDocker