docs: clean up README for Obsta Labs alignment

Author: Test

README.md

@@ -1,73 +1,72 @@
 # rdsspectre
 
-Managed database waste and security auditor for AWS RDS and GCP Cloud SQL.
+[![CI](https://github.com/ppiankov/rdsspectre/actions/workflows/ci.yml/badge.svg)](https://github.com/ppiankov/rdsspectre/actions/workflows/ci.yml)
+[![Go Report Card](https://goreportcard.com/badge/github.com/ppiankov/rdsspectre)](https://goreportcard.com/report/github.com/ppiankov/rdsspectre)
+
+**rdsspectre** — Managed database waste and security auditor for RDS and Cloud SQL. Part of [SpectreHub](https://github.com/ppiankov/spectrehub).
 
 ## What it is
 
-A read-only CLI tool that scans managed database instances for idle, oversized, unencrypted, publicly accessible, and misconfigured databases. Each finding includes severity and estimated monthly waste in USD.
+- Scans AWS RDS and GCP Cloud SQL for idle, oversized, and misconfigured instances
+- Detects unencrypted databases, public accessibility, and missing backups
+- Estimates monthly waste in USD per finding
+- Generates IAM policy and config file via init command
+- Outputs text, JSON, SARIF, and SpectreHub formats
 
 ## What it is NOT
 
 - Not a database query tool or performance profiler
 - Not a migration or modification tool — strictly read-only
-- Not a replacement for AWS Trusted Advisor or GCP Recommender — deeper, database-specific checks
+- Not a replacement for Trusted Advisor or GCP Recommender
+
+## Quick start
 
-## Quick Start
+### Homebrew
+
+```sh
+brew tap ppiankov/tap
+brew install rdsspectre
+```
 
-```bash
-# Install
-go install github.com/ppiankov/rdsspectre/cmd/rdsspectre@latest
+### From source
 
-# Generate config and IAM policy
-rdsspectre init
+```sh
+git clone https://github.com/ppiankov/rdsspectre.git
+cd rdsspectre
+make build
+```
 
-# Scan AWS RDS
-rdsspectre aws --region us-east-1
+### Usage
 
-# Scan GCP Cloud SQL
-rdsspectre gcp --project my-project
+```sh
+rdsspectre aws --region us-east-1 --format json
 ```
 
-## Usage
+## CLI commands
 
-```bash
-# AWS RDS scan with custom thresholds
-rdsspectre aws --region us-east-1 --idle-days 7 --cpu-threshold 15 --format json
+| Command | Description |
+|---------|-------------|
+| `rdsspectre aws` | Scan AWS RDS instances |
+| `rdsspectre gcp` | Scan GCP Cloud SQL instances |
+| `rdsspectre init` | Generate IAM policy and config file |
+| `rdsspectre version` | Print version |
 
-# GCP Cloud SQL scan
-rdsspectre gcp --project my-project --format json
+## SpectreHub integration
 
-# Output to file
-rdsspectre aws --region us-east-1 -o report.json --format json
+rdsspectre feeds managed database waste findings into [SpectreHub](https://github.com/ppiankov/spectrehub) for unified visibility across your infrastructure.
 
-# Exclude specific instances
-rdsspectre aws --exclude-tags env=production
-rdsspectre gcp --project my-project --exclude-tags env=production
+```sh
+spectrehub collect --tool rdsspectre
 ```
 
-## Finding Types
-
-| Finding | Severity | AWS | GCP | Description |
-|---------|----------|-----|-----|-------------|
-| IDLE_INSTANCE | high | yes | — | CPU < 5%, zero connections over N days |
-| OVERSIZED_INSTANCE | high | yes | — | CPU p95 < 20% with active connections |
-| UNENCRYPTED_STORAGE | critical | yes | — | Storage encryption disabled |
-| PUBLIC_ACCESS | critical | yes | yes | Instance publicly accessible |
-| NO_AUTOMATED_BACKUPS | critical | yes | yes | Backup retention period is zero |
-| STALE_SNAPSHOT | medium | yes | — | Manual snapshot older than threshold |
-| UNUSED_READ_REPLICA | high | yes | yes | Read replica with zero connections |
-| NO_MULTI_AZ | high | yes | yes | Single-AZ / ZONAL deployment |
-| OLD_ENGINE_VERSION | medium | yes | yes | 2+ major versions behind current |
-| NO_DELETION_PROTECTION | medium | yes | yes | Deletion protection disabled |
-| PARAMETER_GROUP_DRIFT | low | yes | — | Non-default parameter group |
-
-## Output Formats
-
-- `text` — human-readable table (default)
-- `json` — spectre/v1 JSON envelope
-- `sarif` — SARIF v2.1.0 for CI integration
-- `spectrehub` — SpectreHub envelope
+## Safety
+
+rdsspectre operates in **read-only mode**. It inspects and reports — never modifies, deletes, or alters your databases.
 
 ## License
 
-MIT
+MIT — see [LICENSE](LICENSE).
+
+---
+
+Built by [Obsta Labs](https://github.com/ppiankov)