foxguard — Fast local security scanner in Rust

Fast by default

Rust-native engine with tree-sitter parsing. No JVM startup, no Python interpreter, no network round-trips.

Repo

foxguard

Semgrep

express

141 files

foxguard

0.284s

Semgrep

17.373s

61x faster

flask

83 files

foxguard

0.084s

Semgrep

7.325s

87x faster

gin

99 files

foxguard

0.516s

Semgrep

8.007s

16x faster

foxguard built-in rules vs Semgrep auto. Run ./benchmarks/run.sh locally to reproduce.

edit

foxguard

fix

commit

What it catches

Framework-aware rules that understand Express sessions, Django CSRF, Gin proxies, JWT flows, and more.

Express / Node

24 rules

Session secrets, cookie flags, JWT hardening, reflected response writes.

sessioncookiesjwtxss

Flask / Django

26 rules

Secret keys, debug mode, CSRF protection, session cookie flags.

secret keyscsrfsessiondebug

Gin / net/http

8 rules

Trusted proxies, missing timeouts, SSRF, TLS verification bypass.

proxiestimeoutsssrftls

< 1s

Single binary

No JVM, no Python runtime, no network calls. Rust-native and fast enough for pre-commit hooks.

hook

Pre-commit ready

Run foxguard init to install a repo-local hook and get a starter .foxguard.yml.

.yaml

Bring your own rules

Load a useful Semgrep-compatible YAML subset on top of built-ins when you need it.

base

Baselines

Accept existing findings once and focus only on new ones with a baseline file.

secret

Secrets scanning

Detect leaked credentials and private keys with redacted output and binary-safe handling.

SARIF

CI-friendly output

Terminal output locally, JSON and SARIF for automation and GitHub Code Scanning.

Semgrep compatibility

Bring your existing rules

Load Semgrep-compatible YAML on top of built-ins with --rules. Supports the structural matching subset most teams actually use.

pattern pattern-regex pattern-either pattern-not pattern-not-regex pattern-inside pattern-not-inside patterns (AND) metavariable-regex paths.include/exclude Full Semgrep syntax

Install

npm / npx

npx foxguard .

Rust / Cargo

cargo install foxguard

Quick start

1.

foxguard init pre-commit hook + config

2.

foxguard . scan everything

3.

foxguard --changed . scan only modified files

4.

foxguard secrets --changed . check for leaked credentials

Rules

58 built-in rules, each mapped to a CWE identifier.

JavaScript / TypeScript 24

js/no-eval critical CWE-95 Use of eval() allows arbitrary code execution

js/no-hardcoded-secret high CWE-798 Hardcoded secret or credential detected

js/no-sql-injection critical CWE-89 SQL injection via string concatenation or template literal

js/no-xss-innerhtml high CWE-79 Assignment to innerHTML may lead to XSS

js/no-command-injection critical CWE-78 Command injection via exec/spawn with dynamic input

js/no-document-write high CWE-79 document.write() with dynamic content enables XSS

js/no-open-redirect medium CWE-601 Open redirect via user-controlled URL

js/no-weak-crypto medium CWE-327 Use of weak cryptographic hash (MD5/SHA1)

js/no-path-traversal high CWE-22 Path traversal via unsanitized user input

js/no-ssrf high CWE-918 SSRF via dynamic outbound request URL

js/no-prototype-pollution high CWE-1321 Prototype pollution via object merge

js/no-unsafe-regex medium CWE-1333 ReDoS-vulnerable regular expression

js/no-cors-star medium CWE-942 Permissive CORS policy (Access-Control-Allow-Origin: *)

js/express-no-hardcoded-session-secret high CWE-798 Hardcoded session secret in express-session config

js/express-cookie-no-secure medium CWE-614 Cookie config missing secure flag

js/express-cookie-no-httponly medium CWE-1004 Cookie config missing httpOnly flag

js/express-cookie-no-samesite medium CWE-352 Cookie config missing a safe sameSite setting

js/express-session-saveuninitialized-true medium CWE-359 express-session configured with saveUninitialized: true

js/express-direct-response-write high CWE-79 XSS via res.send/res.write with user input

js/jwt-hardcoded-secret high CWE-798 JWT signing or verification with a hardcoded secret

js/jwt-none-algorithm high CWE-347 JWT configured to use the none algorithm

js/jwt-ignore-expiration high CWE-613 JWT verification configured to ignore token expiration

js/jwt-decode-without-verify high CWE-347 JWT decoded without signature verification

js/jwt-verify-missing-algorithms high CWE-347 JWT verification without an explicit algorithms allowlist

Python 26

py/no-eval critical CWE-95 Use of eval()/exec() allows arbitrary code execution

py/no-hardcoded-secret high CWE-798 Hardcoded secret or credential detected

py/no-sql-injection critical CWE-89 SQL injection via string formatting

py/no-command-injection critical CWE-78 Command injection via os.system/subprocess

py/no-path-traversal high CWE-22 Path traversal via unsanitized user input

py/no-ssrf high CWE-918 SSRF via dynamic outbound request URL

py/no-weak-crypto medium CWE-327 Use of weak cryptographic hash (MD5/SHA1)

py/no-pickle high CWE-502 Deserialization of untrusted data via pickle

py/no-yaml-load high CWE-502 Unsafe yaml.load() without SafeLoader

py/no-debug-true medium CWE-489 DEBUG=True left enabled in production config

py/no-open-redirect medium CWE-601 Open redirect via user-controlled URL

py/no-cors-star medium CWE-942 Permissive CORS policy (CORS_ALLOW_ALL_ORIGINS)

py/flask-debug-mode high CWE-489 Flask app.run(debug=True) exposes debugger in production

py/django-secret-key-hardcoded high CWE-798 Django SECRET_KEY hardcoded in source

py/flask-secret-key-hardcoded high CWE-798 Flask SECRET_KEY hardcoded in source

py/session-cookie-secure-disabled medium CWE-614 SESSION_COOKIE_SECURE disabled in source

py/session-cookie-httponly-disabled medium CWE-1004 SESSION_COOKIE_HTTPONLY disabled in source

py/session-cookie-samesite-disabled medium CWE-352 SESSION_COOKIE_SAMESITE disabled in source

py/csrf-cookie-secure-disabled medium CWE-614 CSRF_COOKIE_SECURE disabled in source

py/csrf-cookie-httponly-disabled medium CWE-1004 CSRF_COOKIE_HTTPONLY disabled in source

py/csrf-cookie-samesite-disabled medium CWE-352 CSRF_COOKIE_SAMESITE disabled in source

py/csrf-exempt high CWE-352 View marked csrf_exempt

py/wtf-csrf-disabled high CWE-352 Flask-WTF CSRF protection disabled in source

py/wtf-csrf-check-default-disabled high CWE-352 Flask-WTF default CSRF checks disabled in source

py/django-allowed-hosts-wildcard medium CWE-346 Django ALLOWED_HOSTS allows all hosts

py/secure-ssl-redirect-disabled medium CWE-319 Django SECURE_SSL_REDIRECT disabled in source

Go 8

go/no-sql-injection critical CWE-89 SQL injection via string concatenation or fmt.Sprintf

go/no-command-injection critical CWE-78 Command injection via exec.Command with dynamic input

go/no-hardcoded-secret high CWE-798 Hardcoded secret or credential detected

go/no-weak-crypto medium CWE-327 Use of weak cryptographic hash (MD5/SHA1)

go/no-ssrf high CWE-918 SSRF via http.Get/http.Post with variable URL

go/insecure-tls-skip-verify high CWE-295 TLS verification disabled with InsecureSkipVerify

go/gin-no-trusted-proxies medium CWE-346 Gin engine without SetTrustedProxies

go/net-http-no-timeout medium CWE-400 http.ListenAndServe without timeout config