interplains/Zero-Breach-Toolkit

Worth trying if you need a low-cost first pass on a device you suspect, but treat it as one input to a decision, not a clean bill of health. The project's own guardrails are unusually explicit about that. If you believe you are under active attack, the README says to contact an expert helpline first, and you do not need to run the tool before asking.

The problem

Someone who may be targeted wants to know whether their phone or computer shows known traces of commercial spyware. Hiring a forensic lab is slow and expensive, and generic antivirus is not built around published spyware indicator lists. This toolkit changes that step: you install Python, download the folder, and run a menu-driven scan on the machine, a connected Android phone, or an iPhone backup, getting a report that names what matched and what the tool could not see.

What's different

The design choices are aimed at evidence handling rather than detection breadth. The check is read-only: it does not alter source evidence or system settings and writes only temporary database snapshots and the reports you request. Ordinary scans make no network requests, Python network calls are blocked during a scan, and redirected paths are refused. That limits the chance of the scan itself revealing who is checking or corrupting what is examined, though the README is careful to say this is not an operating-system network sandbox and points to the privacy document for the boundaries.

Indicator lists can be refreshed with --update, which is the one internet step and is recommended every few weeks; without it, only a small built-in set is used. Android collection is separate and downloads a pinned official collector after consent. The trade-off is that this is a trace-matching tool against published lists, not a full forensic examination: every report states the strength of the evidence and lists places that could not be checked, and a clean result is never presented as proof of safety.

Who should try it

A good fit is a journalist, activist, or family member helping someone who has a Windows laptop, a Mac, or a phone with a USB cable, and who can follow a step-by-step guide to produce a report they can keep for a professional. The README is written for people with no technical experience and the help table addresses common setup errors. A poor fit is someone expecting an automatic verdict on an iPhone: the iPhone path checks a local encrypted backup rather than the phone itself, and the report's list of unchecked locations is central to reading the result.

The Mac path also requires giving Terminal Full Disk Access; without it, Safari records and some folders are skipped and reported as not checked. The Android path requires enabling USB debugging on the phone.

Requirements and limitations

You need Python 3.8 or newer, no administrator rights, and no extra packages; Windows users must tick the PATH option during installation. Setup is per-computer, and Mac users must grant Terminal Full Disk Access before scanning. Scans should run with browsers and chat apps closed, and refreshing indicators is an ongoing step every few weeks. The full report can contain usernames, file paths, browsing details, SMS senders and message excerpts, so it should stay private; a summary JSON option leaves out artifact text and indicator values but is not forensic evidence. The README groups the step-by-step guides by platform, including Windows, Mac, Android and iPhone, and the privacy notes spell out what the update and collection commands download.

HotRepo's take

HotRepo observed the repository at 664 total stars and #12 on its Python new-repository board on 2026-10-28; that is a single dated snapshot, not a growth measurement, and the project was created only two days earlier. Comparable daily history is insufficient to judge persistence, so the star count says little about whether the indicator lists will keep pace with future spyware. Before relying on it, check how --update handles list sources and how quickly the built-in indicators are refreshed.