남보다 먼저, 내 코드를 검사하세요.

$ pgard --help
pgard - local security checks for GitHub projects you are authorized to scan

Usage:
  pgard                         interactive menu (arrow keys, Enter, Esc, ?)
  pgard project verify          check repository, GitHub identity, owner approval,
                                current access and merged contribution
  pgard scan                    code and configuration + Git history
  pgard scan code               current code and configuration
  pgard scan history            Git history and tracked files (secrets, risky files)
  pgard scan web [--port N]     anonymous read-only checks of a local HTTP service
  pgard scan all [--port N]     code + history + local HTTP service
  pgard dashboard [--target-port N]
                                start the local web dashboard
  pgard rules list [--language js|ts|react|vue|go|java|kotlin] [--lang en|ko]
                                supported rules and unsupported areas
  pgard history clear --all | --repo owner/name
                                delete stored scan results (all, or one repository)
  pgard baseline set [--from-current] | show | clear
                                keep a scan as this repository's baseline; later
                                scans list matching findings under "In baseline"
  pgard doctor                  diagnose the environment (not an authorization)
  pgard advisories update       download public OSV vulnerability data (npm, Go)
                                to this computer; the only non-GitHub download
  pgard login                   sign in to GitHub once and save it in the OS keychain
  pgard logout                  remove the saved GitHub sign-in from the OS keychain
  pgard --help | <command> --help
  pgard --version

The target is always the Git root of the current directory. Every scan re-runs the
authorization gate; only the GitHub sign-in is reused. Code and results are
processed locally; PGARD contacts GitHub for sign-in and repository metadata only.
GitHub pages open in the browser automatically when stdout is a terminal; pass
--no-browser to scan, project verify, login or dashboard to only print the links.

Exit codes:
  0    requested scope completed (findings may exist)
  2    invalid command, option or value
  3    repository, authorization or contribution check failed
  4    part of the scan or the report export failed
  5    internal error
  130  cancelled
  143  terminated by SIGTERM while the panel view was open

$ pgard rules list --language java
pgard 0.1.0 - detection criteria 2026.10-mvp.4
Language filter: java (rules for any language are included)

Code rules (current files)
  PG-CMD-003     high     OS command built from dynamic strings in Java/Kotlin (Runtime.exec, ProcessBuilder, Commons Exec) [java, kotlin]
  PG-PATH-002    high     File path from request input or an archive entry used in Java/Kotlin file access (path traversal, zip slip) [java, kotlin]
  PG-SQL-005     high     SQL built from dynamic strings in Java/Kotlin JDBC, JPA/Hibernate or MyBatis code [java, kotlin]

Git history rules
  PG-HYGIENE-001 info     Dependency directory committed to Git [any]
  PG-SECRET-001  high     Environment file committed to Git [any]
  PG-SECRET-002  high     Secret in a tracked file [any]
  PG-SECRET-003  high     Secret found in Git history [any]

Local HTTP rules (anonymous GET, any language)
  PG-WEB-001     low      Content-Security-Policy header is missing
  PG-WEB-002     low      Clickjacking protection header is missing
  PG-WEB-003     info     X-Content-Type-Options: nosniff is missing
  PG-WEB-004     info     Referrer-Policy header is missing
  PG-WEB-005     low      Cookie is set without HttpOnly
  PG-WEB-006     low      Cookie is set without SameSite
  PG-WEB-007     info     Cookie is set without Secure
  PG-WEB-008     medium   CORS allows any origin together with credentials
  PG-WEB-009     high     CORS reflects an arbitrary Origin or trusts `null` with credentials
  PG-WEB-010     low      Server software version is disclosed
  PG-WEB-011     medium   Directory listing is enabled
  PG-WEB-012     high     A .env file is served over HTTP
  PG-WEB-013     high     The .git directory is served over HTTP

Not covered in this version
  - Direct database connections
  - Docker / container configuration
  - Performance and load testing
  - Remote (non-loopback) web services
  - Authenticated (logged-in) web browsing
  - Form submission and other state-changing requests
  - Known-vulnerability (CVE/advisory) lookups for dependencies: PGARD ships no vulnerability database