FestIn

Credentialless discovery and monitoring of exposed S3-compatible cloud storage from domains, DNS and web crawling.

FestIn finds exposed S3 buckets tied to your domains and, since the 0.3 release, ships a multi-project, multi-user monitoring dashboard that watches them continuously: scheduled rescans, persisted findings, an exposure trend chart and a REST API — in an industrial ops-console UI.

See it in action

HOME — the exposure radar. Data-generated headline, severity split, scan outcomes and rankings — the full page:

SCANS — every execution with status tokens and project/status filters:

FINDINGS — secrets classified by severity, with rule, bucket, object and redacted match:

Project detail — domains, scheduled scans and recent executions per project:

What's new in 0.3

• Monitoring dashboard (festin-serve): multi-project (organize domains into projects), multi-user (JWT + admin/viewer roles), scheduled scans, full REST API.
• Scan results persisted as real rows — buckets and findings are queryable, not just counters.
• Exposure trend — a data-generated headline chart: is your exposure going up or down over 14 days?
• Ops-console UI — vanilla-JS SPA, no build step, dark industrial design.
• Docker image on Docker Hub: cr0hn/festin.

Full changelog in the documentation.

Quick start

# scanner: one-shot audit
uvx festin scan example.com --permute --export sarif --output findings.sarif

# dashboard: continuous monitoring
uvx festin-serve --port 8420
# open http://127.0.0.1:8420 — the first account you register becomes admin

Or with Docker:

docker run -d --name festin \
  -p 8420:8420 \
  -e FESTIN_JWT_SECRET="$(python3 -c 'import secrets; print(secrets.token_urlsafe(32))')" \
  -v festin-data:/data \
  cr0hn/festin:latest

More install options (pip, uv, dev setup) in the installation guide.

Documentation

Everything lives in the MkDocs Material site — installation, tutorials, scanner CLI reference, dashboard tour, REST API, configuration, Docker/Kubernetes/HA deployment, security hardening and a runbook:

Read the documentation →

Build it locally:

uv sync --group docs
uv run mkdocs serve    # http://localhost:8000

Development

git clone https://github.com/cr0hn/festin.git && cd festin
uv sync --group dev
timeout 130 uv run pytest --timeout=30 -q    # 305 tests — always with the timeout

Contribution rules, complexity gates and verification checklist: reference/development.

License

Free and open for personal and professional use — no cost, no restrictions on what you use it for.

If you want to build a paid service or commercial product around FestIn (SaaS, managed offering, redistribution as part of a paid platform...), that use case is paid and requires a separate agreement with the author first. Contact: daniel@danielalfocea.com.

See LICENSE for the full terms.