Guard

 ███  █   █  ███  ████  ████  
█     █   █ █   █ █   █ █   █ 
█  ██ █   █ █████ ████  █   █ 
█   █ █   █ █   █ █  █  █   █ 
 ███   ███  █   █ █   █ ████                                  
                                

⚠️ Work in progress — APIs and output formats may change.

A static analysis security tool for any codebase built in Rust. Guard uses AST traversal (via OXC) for JS/TS and tree-sitter for other languages to detect security vulnerabilities with higher accuracy than regex-based approaches. Results are viewable directly in the terminal or through a local Flutter dashboard.

---

Features

• SQL Injection — detects raw SQL in template literals, string concatenations, and direct string args
• Eval & Dangerous Calls — flags eval(), Function(), and similar dangerous call expressions
• Hardcoded Secrets — catches API keys, tokens, and credentials embedded in source code
• AST-based — fewer false positives than regex scanners
• CI/CD friendly CLI with clean exit codes
• Local web dashboard for browsing findings

---

How a Scan Works

This example shows the JavaScript scan flow. Other languages follow the same high-level path with a language-specific parser and analyzer.

CLI scan path
    └── parse code with language-specific parser (OXC for JS/TS, tree-sitter for Go, etc.)
            └── build AST
                    └── query/traverse AST for security patterns
                            └── report() → push to findings Vec
                                    └── store in AppState
                                            └── serve via GET /api/results/{scan_id}
                                                    └── Flutter dashboard renders findings

Server Layout

localhost:3000/
├── /api/results/{scan_id}   # JSON findings endpoint
├── /app                     # Flutter SPA (base-href: /app/)
└── /                        # redirects → /app

---

Usage

Scan a file and open the dashboard

guard scan path/to/(file or any dir)

This will:

1. Start a local server on http://localhost:3000
2. Run the scan against the provided file
3. Open the dashboard automatically at the results page
4. Keep running until Ctrl+C

🧾 SARIF Output (GitHub Code Scanning)

Guard can export scan results in SARIF format, which is compatible with GitHub Code Scanning, VS Code SARIF Viewer, and other SARIF tools.

---

Generate quick analysis

guard analyze path/to/(file or dir)

Generate SARIF report

guard scan path/to/(file or dir) --sarif

Note

This will:

1. Run the scan as usual
2. Generate a SARIF report from the findings
3. Save it to a file automatically
4. Output file naming

If no output path is provided, Guard generates a default file like guard-20260615_142355-report.sarif checkout examples to see the sample SARIF output.

Guard SARIF output is compatible with:

• GitHub Code Scanning
• VS Code SARIF Viewer
• Other SARIF-compliant tools

Start the server only

guard serve

---

Building

# build the rust CLI
cargo build --release

# build the flutter dashboard
cd dashboard
flutter build web --base-href /app/

---

Vulnerability Types

Type	Example
SQL Injection	`SELECT * FROM ${table}`
Eval	eval(userInput)
Hardcoded Secret	const API_KEY = "sk-..."

---

Planned

• Resolution of Symbol and Calls
• Call Graph (cross file referencing)
• Taint Analysis
• Python support
• Java support

Completed

• JavaScript support
• TypeScript support
• Go support
• SARIF output format (GitHub Code Scanning compatible)
• SymbolTable and CallTable extraction