CodeGuard

01 Executive Summary & Product Vision

CodeGuard is a fast, developer-friendly static application security testing (SAST) tool engineered to eliminate security anti-patterns before code reaches production.

Following its v2.0 makeover, CodeGuard bridges the gap between lightweight linters and heavy enterprise SAST suites. It requires no server infrastructure, no database, no Docker daemon, and zero cloud API keys. Everything runs 100% offline, executing deterministic AST and Tree-sitter semantic analysis in milliseconds.

       ┌────────────────────────────────────────────────────────────────────────┐
       │                             CodeGuard                                  │
       │   Fast • 100% Offline • Zero Noise • Unified Policy Across All Gates   │
       └───────────────────────────────────┬────────────────────────────────────┘
                                           │
         ┌───────────────────┬─────────────┴───────┬────────────────────┐
         ▼                   ▼                     ▼                    ▼
   [Local Editor]      [Pre-Commit]          [PR / CI Gate]      [Audit & Baseline]
   Sub-second scan     Block bad code        Diff-aware PR       Manage tech debt &
   while coding        before commit         checks & SARIF      track suppressions

02 Where CodeGuard Fits in Your Development Workflow

CodeGuard is designed around a multi-gated security model, ensuring that security validation happens continuously throughout the developer workflow rather than as a delayed gate at release time.

The 5 Gates of CodeGuard

Security as continuous craft — five discrete validation thresholds eliminating risk at each phase of authoring, integration, and governance:

03 How CodeGuard Creates Value

04 Current Feature Catalog (v2.0)

4.1 Multi-Language Engine

CodeGuard features a unified, highly optimized analysis pipeline supporting:

4.2 Security & Meta Rules

Every rule in CodeGuard has a permanent ID, standardized severity, CWE/OWASP classification, and actionable remediation guide:

4.3 CLI Commands & Tooling Capabilities

4.4 Centralized Configuration (codeguard.toml)

CodeGuard can be configured via codeguard.toml, .codeguard.toml, or [tool.codeguard] inside pyproject.toml:

[codeguard]
include   = ["src/**", "lib/**"]
exclude   = ["**/*.min.js", "tests/fixtures/**"]
languages = ["python", "javascript", "typescript"]
gitignore = true
fail_on   = "high"              # exit 1 on "high" or "critical" findings
output    = "human"             # default output format
jobs      = 0                   # 0 = auto-detect CPU cores
baseline  = ".codeguard-baseline.json"

[codeguard.rules]
disable = []                    # disable specific rule IDs
enable  = []                    # specify an allowlist of rule IDs

[codeguard.rules.CG-SEC-001]
severity = "critical"          # remap rule severity

[[codeguard.overrides]]
path    = "legacy_scripts/**"   # monorepo path-specific override
disable = ["CG-SEC-002"]

4.5 Packaging & Distribution Formats

05 Quickstart: Rolling Out CodeGuard in 3 Steps

# 1. Install CodeGuard globally
pipx install codeguard-cli

# 2. Generate configuration
codeguard init

# 3. Snapshot existing findings so CI doesn't block on day 1
codeguard baseline create

repos:
  - repo: https://github.com/mevichitra/codeguard
    rev: v2.0.0
    hooks:
      - id: codeguard

name: Security Scan (CodeGuard)
on:
  pull_request:
    branches: [main]

permissions:
  contents: read
  security-events: write

jobs:
  security-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0  # Required for diff-aware scanning

      - name: Run CodeGuard
        uses: mevichitra/codeguard/action@v2
        with:
          fail-on: high

06 Why Developers & Security Teams Love CodeGuard