Open source, MIT
macOS, Linux, Windows
Pre-release, v0.1.0 not published yetv0.1.0

Scan your own code before anyone else does.

Name: PGARD — Security scanner for your own projects
Author: JadenMeister

Security scanner for your own projects — code, Git history and your local web app, checked on your machine.

Star on GitHub Get started

pgard scan — test fixture, excerpt

$ pgard scan
PGARD scan result - Partial - some requested areas did not fully run
Repository owner/name @ abcdef123456 - scopes: code, history

Summary
  Areas         2 requested — 1 completed, 1 partial (1 not selected)
  Rules         3 rules ran (1 in partially scanned areas)
  Max per rule  152 files, 340 commits
  Elapsed       5.0 s

Findings by severity (3 total)
  Critical ############################## 1
  High     ############################## 1
  Medium   ############################## 1
  Low      0
  Info     0

...

Findings (3): 1 confirmed, 2 suspected (needs review)
  [CRITICAL] User input concatenated into SQL (confirmed)
      src/api/users.ts:3  PG-SQL-001 - confidence medium

Install

$ npm install -g pgard

First release coming soon — build from source today

$ git clone https://github.com/JadenMeister/pgard.git && cd pgard && npm ci && npm run build

It only scans GitHub repositories you are authorized for, checks that again on every scan, and never uploads your code or results. What it does not do

pgard scan — result screen (test fixture, excerpt)

$ pgard scan
PGARD scan result - Partial - some requested areas did not fully run
Repository owner/name @ abcdef123456 - scopes: code, history

Summary
  Areas         2 requested — 1 completed, 1 partial (1 not selected)
  Rules         3 rules ran (1 in partially scanned areas)
  Max per rule  152 files, 340 commits
  Elapsed       5.0 s

Findings by severity (3 total)
  Critical ############################## 1
  High     ############################## 1
  Medium   ############################## 1
  Low      0
  Info     0

...

Findings (3): 1 confirmed, 2 suspected (needs review)
  [CRITICAL] User input concatenated into SQL (confirmed)
      src/api/users.ts:3  PG-SQL-001 - confidence medium
      Evidence: req.query -> concat -> query()
      Fix: Use parameters
      Standards:
        A05:2025 Injection https://top10.owasp.org/2025/A05_2025-Injection/
        CWE-89 Improper Neutralization of Special El... https://cwe.mitre.org/data/definitions/89.html
  ...

Coverage
  [ok] source:typescript (Completed)
  [partial] history:commits (Partial)
  [not selected] web:anonymous (Not selected)

Standards coverage (OWASP Top 10 2025)
  ...
  [rules ran]     A05 Injection - 3 of 37 mapped CWEs have rules (PG-SQL-001, PG-XSS-001)
  ...
  CWE Top 25 2025: 2 rules ran, 0 rules partial, 4 not run, 19 no rules
  Rules ran means the mapped rules ran to completion in this scan. It does not mean the project is safe or that the category is covered: see how many of its CWEs have rules. Full detail per entry: --format json (standardsCoverage, ruleStats).

PGARD does not ship or query a vulnerability database. Findings come from the code itself (query statements, server code, configuration), Git history and, if selected, local HTTP checks. Dependency versions are not checked against known vulnerabilities.

Overview

PGARD panels  owner/name @ abcdef123456  Partial - some r...
[Overview]  Charts  Coverage  Findings (12)
Summary
  Areas         3 requested - 1 completed, 1 partial, 1 not
                tested (1 not selected)
  Rules         2 rules ran (1 in partially scanned areas)
  Max per rule  152 files, 500 commits
  Elapsed       5.0 s

Findings by severity (12 total)
  Critical 1
  High     4
  Medium   4
  Low      2
  Info     1
Tab: panel  Up/Down: scroll  ?: help  Esc: back

Charts

PGARD panels  owner/name @ abcdef123456  Partial - some r...
Overview  [Charts]  Coverage  Findings (12)
By OWASP Top 10 2025 category
  A01 Broken Access Control 4
  A05 Injection             4
  No OWASP mapping          4

By area
  code    11
  history 1
  web     1
Tab: panel  Up/Down: scroll  ?: help  Esc: back

Coverage

PGARD panels  owner/name @ abcdef123456  Partial - some r...
Overview  Charts  [Coverage]  Findings (12)
Coverage
  [ok] source:typescript (Completed)
  [partial] history:secrets (Partial)
      Only the last 500 commits were read because the
      repository history is very long.
  [not tested] web:anonymous (Not tested)
      No confirmed local web target.
  [not selected] dependencies:npm (Not selected)
Tab: panel  Up/Down: scroll  ?: help  Esc: back

Findings

PGARD panels  owner/name @ abcdef123456  Partial - some r...
Overview  Charts  Coverage  [Findings (12)]
> [CRITICAL] confirmed     src/module1/handler.ts:11
  [HIGH]     suspected     config/.env (commit 0123456789ab)
  [HIGH]     suspected     src/module11/handler.ts:21
  [HIGH]     suspected     src/module2/handler.ts:12
  [HIGH]     suspected     (suppressed) src/module4/handl...
  [MEDIUM]   suspected     http://127.0.0.1:3000/admin
  [MEDIUM]   suspected     src/module12/handler.ts:22
  [MEDIUM]   suspected     src/module5/handler.ts:15
  [MEDIUM]   suspected     (baseline) src/module7/handler...
  [LOW]      suspected     src/module9/handler.ts:19
  [LOW]      informational src/module8/handler.ts:18
  [INFO]     informational src/module10/handler.ts:20
Tab: panel  Up/Down: scroll  ?: help  Esc: back

pgard scan --panels — read-only full-screen view in the terminal (test fixture, 60x20)

pgard rules list --language java

$ pgard rules list --language java
pgard 0.1.0 - detection criteria 2026.10-mvp.6
Language filter: java (rules for any language are included)

Code rules (current files)
  PG-AUTH-001    high     Password stored without hashing [javascript, typescript, java, kotlin]
  PG-CMD-003     high     OS command built from dynamic strings in Java/Kotlin (Runtime.exec, ProcessBuilder, Commons Exec) [java, kotlin]
  PG-CONF-001    medium   Spring Security or Spring Boot configuration that weakens access control [java, kotlin]
  PG-COOKIE-001  medium   Session or auth cookie without HttpOnly/Secure/SameSite [javascript, typescript, go, java, kotlin]
  PG-CRYPTO-001  high     Weak hash (MD5/SHA-1) used for passwords [javascript, typescript, go, java, kotlin]
  PG-CRYPTO-002  high     Hardcoded cryptographic key or signing secret [javascript, typescript, go, java, kotlin]
  PG-CRYPTO-003  medium   Broken or deprecated cipher, fixed IV or predictable random value [javascript, typescript, java, kotlin]
  PG-CSRF-001    medium   Cookie-authenticated state-changing routes without visible CSRF protection [javascript, typescript, java, kotlin]
  PG-PATH-002    high     File path from request input or an archive entry used in Java/Kotlin file access (path traversal, zip slip) [java, kotlin]
  PG-SQL-005     high     SQL built from dynamic strings in Java/Kotlin JDBC, JPA/Hibernate or MyBatis code [java, kotlin]
  PG-SSRF-002    high     Server-side HTTP request to a URL from request input in Java/Kotlin [java, kotlin]
  PG-XSS-004     high     Request data written to an HTML response in Java/Kotlin (servlet writer, JSP, Thymeleaf th:utext) [java, kotlin]

Git history rules
  PG-HYGIENE-001 info     Dependency directory committed to Git [any]
  PG-SECRET-001  high     Environment file committed to Git [any]
  PG-SECRET-002  high     Secret in a tracked file [any]
  PG-SECRET-003  high     Secret found in Git history [any]

Local HTTP rules (anonymous GET, any language)
  PG-WEB-001     low      Content-Security-Policy header is missing
  PG-WEB-002     low      Clickjacking protection header is missing
  PG-WEB-003     info     X-Content-Type-Options: nosniff is missing
  PG-WEB-004     info     Referrer-Policy header is missing
  PG-WEB-005     low      Cookie is set without HttpOnly
  PG-WEB-006     low      Cookie is set without SameSite
  PG-WEB-007     info     Cookie is set without Secure
  PG-WEB-008     medium   CORS allows any origin together with credentials
  PG-WEB-009     high     CORS reflects an arbitrary Origin or trusts `null` with credentials
  PG-WEB-010     low      Server software version is disclosed
  PG-WEB-011     medium   Directory listing is enabled
  PG-WEB-012     high     A .env file is served over HTTP
  PG-WEB-013     high     The .git directory is served over HTTP

Not covered in this version
  - Direct database connections
  - Docker / container configuration
  - Performance and load testing
  - Remote (non-loopback) web services
  - Authenticated (logged-in) web browsing
  - Form submission and other state-changing requests
  - Known-vulnerability (CVE/advisory) lookups for dependencies: PGARD ships no vulnerability database

pgard --help

$ pgard --help
pgard - local security checks for GitHub projects you are authorized to scan

Usage:
  pgard                         interactive menu (arrow keys, Enter, Esc, ?)
  pgard project verify          check repository, GitHub identity, owner approval,
                                current access and merged contribution
  pgard scan                    code and configuration + Git history
  pgard scan code               current code and configuration
  pgard scan history            Git history and tracked files (secrets, risky files)
  pgard scan web [--port N]     anonymous read-only checks of a local HTTP service
  pgard scan all [--port N]     code + history + local HTTP service
  pgard dashboard [--target-port N]
                                start the local web dashboard
  pgard rules list [--language js|ts|react|vue|go|java|kotlin] [--lang en|ko]
                                supported rules and unsupported areas
  pgard history clear --all | --repo owner/name
                                delete stored scan results (all, or one repository)
  pgard baseline set [--from-current] | show | clear
                                keep a scan as this repository's baseline; later
                                scans list matching findings under "In baseline"
  pgard doctor                  diagnose the environment (not an authorization)
  pgard advisories update       download public OSV vulnerability data (npm, Go)
                                to this computer; the only non-GitHub download
  pgard login                   sign in to GitHub once and save it in the OS keychain
  pgard logout                  remove the saved GitHub sign-in from the OS keychain
  pgard --help | <command> --help
  pgard --version

The target is always the Git root of the current directory. Every scan re-runs the
authorization gate; only the GitHub sign-in is reused. Code and results are
processed locally; PGARD contacts GitHub for sign-in and repository metadata only.
GitHub pages open in the browser automatically when stdout is a terminal; pass
--no-browser to scan, project verify, login or dashboard to only print the links.

Exit codes:
  0    requested scope completed (findings may exist)
  2    invalid command, option or value
  3    repository, authorization or contribution check failed
  4    part of the scan or the report export failed
  5    internal error
  130  cancelled
  143  terminated by SIGTERM while the panel view was open

Scan result and panel view: test-snapshot fixture data for a placeholder project, cut at ..., not a real scan. Help and rules list: real output of the built CLI.

Get started. In three steps.

Build from sourceInstall

Needs Node.js 22.23.4, 24.22.1 or 26.12.1 (or a newer patch) and Git. The second line puts pgard on your PATH.

Needs Node.js 22.23.4, 24.22.1 or 26.12.1 (or a newer patch) and Git. Homebrew works too.

$ git clone https://github.com/JadenMeister/pgard.git && cd pgard && npm ci && npm run build

$ npm link -w @pgard/cli

$ npm install -g pgard
Sign in and approve

Sign in to GitHub once (kept in your OS keychain). The owner installs the PGARD GitHub App; PGARD prints the link if it is missing.

$ pgard login
Scan

From your project root. Authorization is checked again; in a terminal, the panel view opens after the text result of a completed or partial scan (not in CI or with PGARD_PANELS=off).

$ pgard scan

Other ways to install: npm, Homebrew

npm and Homebrew come with the first release. Until then npm install -g pgard installs only a placeholder package with no pgard command, and the Homebrew tap does not exist yet.

$ npm install -g pgard$ brew install jadenmeister/pgard/pgard

$ brew tap jadenmeister/pgard$ brew install pgard

pgard doctor checks your setup; it is not an authorization. Without npm link, run node apps/cli/dist/bin/pgard.js from the clone. Every command and option is in the README.

What it checks. Three areas, picked per scan.

Every result says which were fully checked. pgard rules list prints the full catalog.

code

SQL injection, XSS, SSRF
OS command execution, path traversal
Weak or hardcoded cryptography, plaintext passwords
Cookie flags, CSRF, no rate limit on login routes

Bounds Current files, uncommitted ones included. Build output and dependencies are skipped and listed.

history

Committed .env files
Secrets in tracked files
Secrets that only exist in history

Bounds Secret values are redacted in every output.

web

Security headers, cookie flags
CORS with credentials
Version disclosure, directory listing
Exposed /.env and /.git

Bounds A service on 127.0.0.1 you confirm. Anonymous GET and HEAD; 20 pages, depth 2, 60 s total.

By language

JavaScript, TypeScript: SQL injection, XSS, SSRF, command execution, path traversal, cryptography, password storage, cookies, CSRF, rate limiting
React, Vue: XSS in dangerouslySetInnerHTML and v-html, plus the JS and TS rules
Go: SQL injection (database/sql, GORM), command execution, path traversal, SSRF, cryptography, cookies
Java, Kotlin: Seven categories: SQL injection, XSS, SSRF, command execution, path traversal, cryptography, configuration
Python, PHP: Two categories only: SQL injection, command execution

Output

terminal: The result with coverage per area, then a read-only panel view.
dashboard: pgard dashboard: a local web dashboard on 127.0.0.1, not hosted anywhere.
json: --format json: the redacted result with a versioned schema.
sarif: --format sarif: SARIF 2.1.0; upload only after exit 0 (how).
html, pdf: --report both: redacted reports, never overwriting a file.
baseline: pgard baseline set: new findings stand out from known ones.
incremental: Repeat scans read only what changed; --full rescans.
standards: OWASP Top 10 2025, CWE Top 25 2025, SEI CERT Java. Never “safe”.
language: Result screens and reports in English or Korean.

How authorization works. Five checks before every scan.

A scanner can also probe other people's code, so every scan, in the CLI and the dashboard, first runs five checks. Only the sign-in is reused and nothing skips them. Missing evidence blocks the scan (exit code 3) and names the failed check.

RepositoryA Git root with one github.com remote.
GitHub identityA one-time sign-in, kept in the OS keychain.
Owner approvalThe owner installed the PGARD GitHub App; for an organization, you are its owner.
Current accessYou have read access right now.
ContributionOwners: history shared with the default branch. Others: a merged pull request or a verified signed commit there.

About the GitHub App

Installing the App on the owner account is the owner's approval, and PGARD can never do it for you. The App ships its public client id; there is no client secret. If the install is all that is missing, PGARD prints the link, waits up to 10 minutes and runs all five checks again from scratch. pgard project verify runs the checks without scanning.

What stays, what leaves. Code and results stay on your machine.

Stays on your machine

Source code, Git history and scan results
The last 20 results per repository, for 90 days. --no-store opts out
Your GitHub sign-in, in the OS keychain, never in a file
Reports you export, only where you choose

Goes over the network

GitHub: sign-in and authorization metadata, incl. local commit SHAs
OSV data, only when you run pgard advisories update
Loopback: one GET / per local port

Details

Stored results are owner-only on macOS and Linux. Authorization metadata means identity, App installation, organization membership, access and contributions. The loopback GET happens only after authorization passes. pgard history clear --all deletes stored results. The OSV download is public vulnerability data. The loopback GET shows you what each local port is before you confirm one.

This website is static pages. It does not scan, collect data or offer sign-in or upload, and it is not the dashboard: the dashboard runs on your computer.

Limits. What it does not do.

coveragePartial coverage is shown; a partial scan exits with code 4.
languagesJava and Kotlin: seven categories. Python and PHP: two.
dependenciesNo known-vulnerability (CVE, OSV) matching yet.
remoteOnly a service on 127.0.0.1 you confirm. No logged-in or state-changing requests.
signalsPattern based: no findings does not mean secure.
accuracySmall corpus (about ten samples per rule), written by the authors.

Next, with no dates: more languages and categories, matching dependencies against advisories, a pre-commit check. Open issues

FAQ. Common questions.

Does my code leave my machine?

No. Code, Git history and results are processed on your computer and not uploaded. The full list of what goes over the network is above.

Why does it need a GitHub sign-in?

To prove you are allowed to scan: your identity, the owner's App installation, your current access and your ownership or contribution. The token is kept in your OS keychain, never in a file.

Which repositories can I scan?

Your own, once the PGARD GitHub App is installed on your account (PGARD guides you through it). Someone else's personal repository only if its owner installed the App and you have current read access plus a merged pull request or a verified signed commit on the default branch. Organization repositories only if you are an active owner of the organization and the App is installed with access to the repository. Remote repositories are never scanned: the target is always the Git root of your current directory.

Is a clean result proof that my project is safe?

No. Every result lists what was not checked, and the standards map shows how few weaknesses in a category have a rule at all. See Limits.

Does it run on Windows?

Yes. macOS, Linux and Windows are supported and CI runs the full test suite on all three. On Windows the sign-in is kept in Credential Manager. The old console window (legacy conhost) and visual rendering have not been verified by a user.

Can I use it in CI?

Not today. Every scan needs a GitHub sign-in that a CI runner does not have, so a runner would produce a blocked result. Run PGARD locally and read --format json or --format sarif and the exit codes (0 completed, 3 blocked, 4 partial) in your own scripts.

How is it different from a hosted scanner?

Your code is not copied to a service. The trade-offs: you run it yourself, there is no hosted dashboard or continuous monitoring, and it asks GitHub whether you are allowed to scan.

How do I report a vulnerability in PGARD?

Privately, not in a public issue: use Report a vulnerability on the repository's Security tab. The security policy has the scope. There is no bug bounty.