Metadata-Version: 2.4
Name: guardmarly
Version: 6.5.0
Summary: Find IDOR, missing authorization, SQL injection, and 30+ vulnerability types in Python, JavaScript, Go, Java, and C#. 100% CVE recall. Zero false positives on clean code. Fully offline. No API keys needed.
Project-URL: Homepage, https://github.com/mattybellx/Guardmarly
Project-URL: Repository, https://github.com/mattybellx/Guardmarly
Project-URL: Issues, https://github.com/mattybellx/Guardmarly/issues
Project-URL: Documentation, https://github.com/mattybellx/Guardmarly#readme
Project-URL: Changelog, https://github.com/mattybellx/Guardmarly/blob/main/CHANGELOG.md
Author: Matty Bell
Maintainer: Matty Bell
License-Expression: MIT
License-File: LICENSE
Keywords: access-control,air-gapped,authentication,authorization,cli,code-review,cwe,devsecops,idor,injection,javascript,linter,offline,owasp,python,sarif,sast,security,static-analysis,vulnerability
Classifier: Development Status :: 5 - Production/Stable
Classifier: Environment :: Console
Classifier: Intended Audience :: Developers
Classifier: License :: OSI Approved :: MIT License
Classifier: Operating System :: OS Independent
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.9
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Classifier: Topic :: Security
Classifier: Topic :: Software Development :: Quality Assurance
Requires-Python: >=3.9
Requires-Dist: rich>=13.0.0
Provides-Extra: dev
Requires-Dist: mypy>=1.10; extra == 'dev'
Requires-Dist: pytest-cov>=5; extra == 'dev'
Requires-Dist: pytest>=8; extra == 'dev'
Requires-Dist: ruff>=0.5; extra == 'dev'
Requires-Dist: tree-sitter-java>=0.21; (python_version >= '3.9') and extra == 'dev'
Requires-Dist: tree-sitter>=0.20; (python_version >= '3.9') and extra == 'dev'
Provides-Extra: enterprise
Requires-Dist: jsonschema>=4.0; extra == 'enterprise'
Requires-Dist: networkx>=3.0; extra == 'enterprise'
Requires-Dist: tree-sitter-java>=0.21; extra == 'enterprise'
Requires-Dist: tree-sitter>=0.20; extra == 'enterprise'
Provides-Extra: fast
Requires-Dist: tree-sitter-java>=0.21; extra == 'fast'
Requires-Dist: tree-sitter>=0.20; extra == 'fast'
Provides-Extra: full
Requires-Dist: jsonschema>=4.0; extra == 'full'
Requires-Dist: networkx>=3.0; extra == 'full'
Requires-Dist: tree-sitter-java>=0.21; extra == 'full'
Requires-Dist: tree-sitter>=0.20; extra == 'full'
Provides-Extra: graph
Requires-Dist: networkx>=3.0; extra == 'graph'
Provides-Extra: schema
Requires-Dist: jsonschema>=4.0; extra == 'schema'
Provides-Extra: test
Requires-Dist: pytest-cov>=5; extra == 'test'
Requires-Dist: pytest>=8; extra == 'test'
Provides-Extra: treesitter
Requires-Dist: tree-sitter-java>=0.21; extra == 'treesitter'
Requires-Dist: tree-sitter>=0.20; extra == 'treesitter'
Provides-Extra: v2
Requires-Dist: jsonschema>=4.0; extra == 'v2'
Requires-Dist: networkx>=3.0; extra == 'v2'
Requires-Dist: tree-sitter-java>=0.21; extra == 'v2'
Requires-Dist: tree-sitter>=0.20; extra == 'v2'
Description-Content-Type: text/markdown

﻿# <img src="guard.png" width="36" style="vertical-align:middle"> Guardmarly — Find authorization bugs before attackers do

<p align="center">
  <strong>The only free SAST with built-in IDOR detection. 100% CVE recall. Fully offline.</strong>
</p>

<p align="center">
  <img src="https://raw.githubusercontent.com/mattybellx/Guardmarly/main/showcase.png" width="800" alt="Guardmarly in action — CWE-22 path traversal detection in VS Code">
</p>

<p align="center">
  <a href="https://guardmarly.onrender.com"><img src="https://img.shields.io/badge/Try%20Online%20Scanner-guardmarly.onrender.com-22c55e?style=for-the-badge" alt="Try Online Scanner"></a>
  <a href="https://pypi.org/project/guardmarly/"><img src="https://img.shields.io/pypi/v/guardmarly?color=22c55e" alt="PyPI"></a>
  <a href="https://github.com/mattybellx/Guardmarly/actions/workflows/ci.yml"><img src="https://github.com/mattybellx/Guardmarly/actions/workflows/ci.yml/badge.svg" alt="CI"></a>
  <a href="https://github.com/mattybellx/Guardmarly/blob/main/LICENSE"><img src="https://img.shields.io/badge/license-MIT-green" alt="License"></a>
</p>

```bash
pip install guardmarly && guardmarly src/
```

---

## The problem

Authorization bugs — **IDOR, missing access controls, privilege escalation** — caused some of the largest data breaches in history. Most SAST tools can't find these bugs because they require tracing data from HTTP routes through auth guards into database queries.

## What Guardmarly does differently

```python
@app.route("/invoice/<id>")
def get_invoice(id):
    return Invoice.query.get(id)
    # ↑ CWE-639 IDOR: any user can view any invoice
    #   Bandit: silent. Semgrep OSS: silent. CodeQL: silent.
    #   Guardmarly: 🚨 CRITICAL — route flows to DB without auth check
```

Guardmarly maps every HTTP route, checks for auth guards, traces data flow to sinks, and flags the gap.

## Quick start

```bash
pip install guardmarly
guardmarly src/                          # text output
guardmarly src/ --format json -o r.json  # JSON report
guardmarly src/ --format sarif           # SARIF for GitHub
guardmarly --show-stats                  # lifetime + today counts
guardmarly --list-rules                  # full rule catalog
```

## Supported languages & CWEs

**5 languages:** Python, JavaScript/TypeScript, Go, Java, C#  
**35+ CWE types:** IDOR (CWE-639), Missing Auth (CWE-862/306), SQLi (CWE-89), Command Injection (CWE-78), XSS (CWE-79), Path Traversal (CWE-22), SSRF (CWE-918), Deserialization (CWE-502), Hardcoded Secrets (CWE-798), Open Redirect (CWE-601), CSRF (CWE-352), XXE (CWE-611), and 25+ more.

## Contributing

```bash
git clone https://github.com/mattybellx/Guardmarly.git
cd Guardmarly && pip install -e ".[dev]"
pytest tests/ -q                       # 1,183+ tests in ~12s
```

## License

MIT © Matty Bell
