foxguard 0.3.2

Most security scanners take 10–30 seconds. foxguard finishes in under one. Fast enough to run on every save, not just in CI.

npx foxguard .

src/auth/login.js
  14:5  CRITICAL  js/no-sql-injection (CWE-89)
        SQL query built with template literal interpolation

src/utils/config.py
   7:1  HIGH      py/no-hardcoded-secret (CWE-798)
        Hardcoded secret in 'api_key'

WARNING 2 issues found: 1 critical, 1 high, 0 medium, 0 low

Why

• Sub-second scans — Rust + tree-sitter + rayon. No JVM, no Python runtime, no network calls.
• 118 built-in rules — SQL injection, XSS, SSRF, command injection, hardcoded secrets, weak crypto, deserialization, and framework-specific checks.
• 10 languages — JavaScript, TypeScript, Python, Go, Ruby, Java, PHP, Rust, C#, Swift.
• Secrets scanning — AWS keys, GitHub/GitLab/Slack/Stripe tokens, private keys. Redacted output.
• Semgrep-compatible — Load your existing YAML rules with --rules. No vendor lock-in.
• Pre-commit ready — foxguard init installs a hook. Scans only changed files with --changed.
• CI-friendly — Terminal, JSON, SARIF output. GitHub Code Scanning integration.

Install

npx foxguard .                      # no install needed
brew install peaktwilight/tap/foxguard  # or via Homebrew
cargo install foxguard              # or via Rust

Built-in coverage

Usage

foxguard .                          # scan everything
foxguard --changed .                # scan only modified files
foxguard --severity high .          # filter by severity
foxguard secrets .                  # scan for leaked credentials
foxguard secrets --changed .        # secrets on changed files only
foxguard --format sarif .           # SARIF for GitHub Code Scanning
foxguard --rules ./my-rules .       # add Semgrep-compatible YAML rules
foxguard init                       # install pre-commit hook

CI Integration

GitHub Actions

name: Security
on: [push, pull_request]
jobs:
  foxguard:
    runs-on: ubuntu-latest
    permissions:
      security-events: write
    steps:
      - uses: actions/checkout@v4
      - uses: peaktwilight/foxguard/action@v0.2.1
        with:
          path: .
          severity: medium
          fail-on-findings: "true"
          upload-sarif: "true"

Findings show up in Security → Code Scanning.

Any CI

npx foxguard@latest .                          # scan
npx foxguard@latest --format sarif . > out.sarif  # SARIF output
npx foxguard@latest secrets .                   # secrets scan

Badge

[![foxguard](https://img.shields.io/badge/foxguard-clean-2dd4bf?logo=data:image/svg%2bxml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHZpZXdCb3g9IjAgMCA2NCA2NCIgZmlsbD0ibm9uZSI+PHBhdGggZD0iTTggOEwyMCAyOEwzMiAyMEw0NCAyOEw1NiA4TDUyIDMyTDQ0IDQ0TDM2IDUySDI4TDIwIDQ0TDEyIDMyTDggOFoiIGZpbGw9IiNGNTlFMEIiIGZpbGwtb3BhY2l0eT0iMC4zIiBzdHJva2U9IiNGNTlFMEIiIHN0cm9rZS13aWR0aD0iMyIgc3Ryb2tlLWxpbmVqb2luPSJyb3VuZCIvPjxjaXJjbGUgY3g9IjI0IiBjeT0iMzIiIHI9IjIuNSIgZmlsbD0iI0Y1OUUwQiIvPjxjaXJjbGUgY3g9IjQwIiBjeT0iMzIiIHI9IjIuNSIgZmlsbD0iI0Y1OUUwQiIvPjwvc3ZnPg==)](https://github.com/peaktwilight/foxguard)

Configuration

foxguard auto-discovers .foxguard.yml from the scan path upward.

scan:
  baseline: .foxguard/baseline.json
  rules: ./semgrep-rules

secrets:
  baseline: .foxguard/secrets-baseline.json
  exclude_paths:
    - fixtures
    - testdata
  ignore_rules:
    - secret/github-token

Semgrep compatibility

Load existing Semgrep/OpenGrep YAML rules with --rules. Supports pattern, pattern-regex, pattern-either, pattern-not, pattern-inside, pattern-not-inside, metavariable-regex, and paths.include/exclude. See COMPATIBILITY.md.

Performance

foxguard built-ins vs Semgrep auto on real repos:

Run ./benchmarks/run.sh locally to reproduce.

Built by Peak Twilight — also building pwnkit, vibecheck, unfuck, whatdiditdo

License

MIT