Guardmarly — Static analysis for authorization gaps and risky code paths

Focused on missing object-level authorization checks (IDOR / broken access control) and related security findings across supported languages.

pip install guardmarly && guardmarly src/

The problem

Authorization bugs — IDOR, missing access controls, privilege escalation — caused some of the largest data breaches in history. Most SAST tools can't find these bugs because they require tracing data from HTTP routes through auth guards into database queries.

What Guardmarly does differently

@app.route("/invoice/<id>")
def get_invoice(id):
    return Invoice.query.get(id)
    # ↑ CWE-639 IDOR: any user can view any invoice
    #   Bandit: silent. Semgrep OSS: silent. CodeQL: silent.
    #   Guardmarly: 🚨 CRITICAL — route flows to DB without auth check

Guardmarly maps every HTTP route, checks for auth guards, traces data flow to sinks, and flags the gap.

Quick start

pip install guardmarly
guardmarly src/                          # text output
guardmarly src/ --format json -o r.json  # JSON report
guardmarly src/ --format sarif           # SARIF for GitHub
guardmarly --show-stats                  # lifetime + today counts
guardmarly --list-rules                  # full rule catalog

Supported languages & CWEs

5 full-AST languages: Python, JavaScript/TypeScript, Go, Java, C#
35+ pattern-aware languages: PHP, Ruby, Kotlin, Swift, Dart, Rust, Scala, Elixir, C/C++, Lua, and 25+ more
35+ CWE types: IDOR (CWE-639), Missing Auth (CWE-862/306), SQLi (CWE-89), Command Injection (CWE-78), XSS (CWE-79), Path Traversal (CWE-22), SSRF (CWE-918), Deserialization (CWE-502), Hardcoded Secrets (CWE-798), Open Redirect (CWE-601), CSRF (CWE-352), XXE (CWE-611), and 25+ more.

Evidence: See CLAIMS_AND_EVIDENCE.md for benchmark methodology, corpus details, and measured results. Detection rates vary by language and CWE category.

Contributing

git clone https://github.com/mattybellx/Guardmarly.git
cd Guardmarly && pip install -e ".[dev]"
pytest tests/ -q                       # 1,183+ tests in ~12s

License

See LICENSE for terms. Guardmarly is source-available software.