It would be nice if lynis would gather (and report in the portal/reports) information about user-accounts:

• Expired or soon to expire passwords (passwd -e)
• Locked accounts (passwd -S )
• Expired accounts (chage -E / chage -l )

Currently, facades implement good exception handling, but resource parsing does not. That means that for a given resource type, if parsing fails for any given resource, the fetch_all method fails and stops, hence not parsing any additional resources.

All resources should be reviewed and updated, to ensure they handle parsing errors.

e.g., for AWS IAM roles (https://github.com/nccgroup/Scou

There are lots of other common development ports that we should check for, including (but not limited to):

• 5000 (Flask and Kestrel's default port)
• 9200 (Elasticsearch's REST API)

The same way we have flags for avoiding indexing and scanning forks or repositories on personal namespaces, we should add one for ignoring repositories that are marked as private, in both GitLab and GitHub.