Docker Context Leak Audit Kit — .dockerignore vs COPY/ADD, Batch Reports

Sold by TradeSheets with secure USDC checkout.

Description

Report-only Docker build-context leak audit: simulate .dockerignore matching against every COPY/ADD instruction in a Dockerfile and report sensitive files (by file name only: .env, keys, credentials) that would be copied into the image, with batch findings.csv, warnings.csv, contexts.csv, summary.json, and exceptions.csv for many contexts in one run — without modifying any input or reading file contents beyond the Dockerfile and .dockerignore. Standard library only, no network, no account. Includes the upstream contextleak tool unchanged with attribution, a batch wrapper, fictional samples, and tests. Classification is a name heuristic, not proof a file holds a secret; the upstream parser does not expand JSON-array COPY/ADD form, so the wrapper warns on every such instruction and those contexts must not be read as clean.