TrustPath CA Trust Auditor

Alerts macOS developers when command-line tools still trust revoked root CAs

Problem

Developers assume they're safe once a browser blocks a compromised root CA, but macOS's built-in curl, git, and python3 still read /etc/ssl/cert.pem and keep trusting it. There's no OS update notice or advisory, so only people who've been burned think to check manually.

Solution

A lightweight CLI or menu bar tool that scans the system trust store and each runtime's CA bundle, compares them against known revocation lists, and alerts on mismatches. Generates a one-click compliance report for security teams.

Users

Backend developers on macOS, security engineers, small teams needing terminal tooling compliance checks

MVP

Scan /etc/ssl/cert.pem and list all roots; compare against public revoked/compromised CA lists; output a highlighted diff report; support cron scheduling and menu bar status

Revenue

Open-source core + team subscription (centralized scanning, report export, Slack/email alerts); one-time purchase for personal edition

Why now

CA trust incidents keep recurring while terminal toolchain trust checks stay ignored—big vendors won't build niche auditors, so an indie dev can cover this fast