guardmarly 6.5.0

Find IDOR, missing authorization, SQL injection, and 30+ vulnerability types in Python, JavaScript, Go, Java, and C#. 100% CVE recall. Zero false positives on clean code. Fully offline. No API keys needed.

Guardmarly — Find authorization bugs before attackers do

The only free SAST with built-in IDOR detection. 100% CVE recall. Fully offline.

pip install guardmarly && guardmarly src/

---

The problem

Authorization bugs — IDOR, missing access controls, privilege escalation — caused some of the largest data breaches in history. Most SAST tools can't find these bugs because they require tracing data from HTTP routes through auth guards into database queries.

What Guardmarly does differently

@app.route("/invoice/<id>")
def get_invoice(id):
    return Invoice.query.get(id)
    # ↑ CWE-639 IDOR: any user can view any invoice
    #   Bandit: silent. Semgrep OSS: silent. CodeQL: silent.
    #   Guardmarly: 🚨 CRITICAL — route flows to DB without auth check

Guardmarly maps every HTTP route, checks for auth guards, traces data flow to sinks, and flags the gap.

Quick start

pip install guardmarly
guardmarly src/                          # text output
guardmarly src/ --format json -o r.json  # JSON report
guardmarly src/ --format sarif           # SARIF for GitHub
guardmarly --show-stats                  # lifetime + today counts
guardmarly --list-rules                  # full rule catalog

Supported languages & CWEs

5 languages: Python, JavaScript/TypeScript, Go, Java, C#
35+ CWE types: IDOR (CWE-639), Missing Auth (CWE-862/306), SQLi (CWE-89), Command Injection (CWE-78), XSS (CWE-79), Path Traversal (CWE-22), SSRF (CWE-918), Deserialization (CWE-502), Hardcoded Secrets (CWE-798), Open Redirect (CWE-601), CSRF (CWE-352), XXE (CWE-611), and 25+ more.

Contributing

git clone https://github.com/mattybellx/Guardmarly.git
cd Guardmarly && pip install -e ".[dev]"
pytest tests/ -q                       # 1,183+ tests in ~12s

License

MIT © Matty Bell