Scan a project for malware tricks before you run it. Built after a fake-recruiter "demo app" tried to steal SSH and AWS keys.
cloneguard is a small, dependency-free Go command-line tool. It only reads files. It never runs, installs, or imports anything from the project it scans.
A common attack goes like this: someone posing as a recruiter sends you a "take-home assignment" or "demo app". You clone it, run npm install or open it in your editor, and it quietly uploads your SSH keys, cloud credentials, browser passwords or crypto wallets. Often the trigger isn't the app itself but an install hook or an editor task that runs the moment you open the folder.
cloneguard is a quick first look that catches the usual tricks, so you can decide whether the project is safe to touch.
