<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Shadow Data Store Detection — API Reference

## Scan Network Logs for Shadow SaaS

```bash
node scripts/agent.js --action scan --input /var/log/proxy.log
```

## Audit Cloud Storage Inventory

```bash
node scripts/agent.js --action cloud-audit --input /tmp/cloud_inventory.json
```

## Scan Endpoint for Local Data Stores

```bash
node scripts/agent.js --action endpoint --input /home/ --extensions ".sql,.db,.csv,.xlsx"
```

## Shadow SaaS Categories

| Category | Services | Risk |
|----------|----------|------|
| personal_cloud | Dropbox, Google Drive, OneDrive, iCloud | Data outside DLP |
| file_share | WeTransfer, SendSpace, AnonFiles, Mega | Uncontrolled transfer |
| unsanctioned_saas | Notion, Airtable, Trello | Third-party storage |
| paste_service | Pastebin, GitHub Gist, Hastebin | Public exposure |
| ai_service | ChatGPT, Claude, Bard | Data in AI training |

## Cloud Audit Output

```json
{
  "name": "dev-customer-export",
  "provider": "aws",
  "issues": ["no classification label", "encryption not enabled"],
  "risk": "high"
}
```

## Endpoint Scan Output

```json
{
  "file": "/home/dev/exports/customers_prod.csv",
  "size_bytes": 52428800,
  "size_mb": 50.0,
  "extension": ".csv"
}
```
