Metadata-Version: 2.4
Name: guardmarly
Version: 6.6.0
Summary: Static analysis for authorization gaps (IDOR/CWE-639), missing authorization, SQL injection, and 30+ vulnerability types across Python, JavaScript, Go, Java, C#, and 35+ other languages.
Project-URL: Homepage, https://github.com/mattybellx/Guardmarly
Project-URL: Repository, https://github.com/mattybellx/Guardmarly
Project-URL: Issues, https://github.com/mattybellx/Guardmarly/issues
Project-URL: Documentation, https://github.com/mattybellx/Guardmarly#readme
Project-URL: Changelog, https://github.com/mattybellx/Guardmarly/blob/main/CHANGELOG.md
Author: Matty Bell
Maintainer: Matty Bell
License: MIT License
        
        Copyright (c) 2026 mattybellx
        
        Permission is hereby granted, free of charge, to any person obtaining a copy
        of this software and associated documentation files (the "Software"), to deal
        in the Software without restriction, including without limitation the rights
        to use, copy, modify, merge, publish, distribute, sublicense, but does not include the right 
        to sell copies of the Software/ Use the software for monetary or commerical gain. And to permit
        persons to whom the Software is furnished to do so, subject to the following conditions:
        
        The above copyright notice and this permission notice shall be included in all
        copies or substantial portions of the Software.
        
        THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
        IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
        FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
        AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
        LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
        OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
        SOFTWARE.
License-File: LICENSE
Keywords: access-control,air-gapped,authentication,authorization,cli,code-review,cwe,devsecops,idor,injection,javascript,linter,offline,owasp,python,sarif,sast,security,static-analysis,vulnerability
Classifier: Development Status :: 4 - Beta
Classifier: Environment :: Console
Classifier: Intended Audience :: Developers
Classifier: Operating System :: OS Independent
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.9
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Classifier: Topic :: Security
Classifier: Topic :: Software Development :: Quality Assurance
Requires-Python: >=3.9
Requires-Dist: rich>=13.0.0
Provides-Extra: dev
Requires-Dist: mypy>=1.10; extra == 'dev'
Requires-Dist: pytest-cov>=5; extra == 'dev'
Requires-Dist: pytest>=8; extra == 'dev'
Requires-Dist: ruff>=0.5; extra == 'dev'
Requires-Dist: tree-sitter-java>=0.21; (python_version >= '3.9') and extra == 'dev'
Requires-Dist: tree-sitter>=0.20; (python_version >= '3.9') and extra == 'dev'
Provides-Extra: enterprise
Requires-Dist: jsonschema>=4.0; extra == 'enterprise'
Requires-Dist: networkx>=3.0; extra == 'enterprise'
Requires-Dist: tree-sitter-java>=0.21; extra == 'enterprise'
Requires-Dist: tree-sitter>=0.20; extra == 'enterprise'
Provides-Extra: fast
Requires-Dist: tree-sitter-java>=0.21; extra == 'fast'
Requires-Dist: tree-sitter>=0.20; extra == 'fast'
Provides-Extra: full
Requires-Dist: jsonschema>=4.0; extra == 'full'
Requires-Dist: networkx>=3.0; extra == 'full'
Requires-Dist: tree-sitter-java>=0.21; extra == 'full'
Requires-Dist: tree-sitter>=0.20; extra == 'full'
Provides-Extra: graph
Requires-Dist: networkx>=3.0; extra == 'graph'
Provides-Extra: schema
Requires-Dist: jsonschema>=4.0; extra == 'schema'
Provides-Extra: test
Requires-Dist: pytest-cov>=5; extra == 'test'
Requires-Dist: pytest>=8; extra == 'test'
Provides-Extra: treesitter
Requires-Dist: tree-sitter-java>=0.21; extra == 'treesitter'
Requires-Dist: tree-sitter>=0.20; extra == 'treesitter'
Provides-Extra: v2
Requires-Dist: jsonschema>=4.0; extra == 'v2'
Requires-Dist: networkx>=3.0; extra == 'v2'
Requires-Dist: tree-sitter-java>=0.21; extra == 'v2'
Requires-Dist: tree-sitter>=0.20; extra == 'v2'
Description-Content-Type: text/markdown

﻿# <img src="guard.png" width="36" style="vertical-align:middle"> Guardmarly — Static analysis for authorization gaps and risky code paths

<p align="center">
  <strong>Focused on missing object-level authorization checks (IDOR / broken access control) and related security findings across supported languages.</strong>
</p>

<p align="center">
  <img src="https://raw.githubusercontent.com/mattybellx/Guardmarly/main/showcase.png" width="800" alt="Guardmarly in action — CWE-22 path traversal detection in VS Code">
</p>

<p align="center">
  <a href="https://guardmarly.onrender.com"><img src="https://img.shields.io/badge/Try%20Online%20Scanner-guardmarly.onrender.com-22c55e?style=for-the-badge" alt="Try Online Scanner"></a>
  <a href="https://pypi.org/project/guardmarly/"><img src="https://img.shields.io/pypi/v/guardmarly?color=22c55e" alt="PyPI"></a>
  <a href="https://github.com/mattybellx/Guardmarly/actions/workflows/ci.yml"><img src="https://github.com/mattybellx/Guardmarly/actions/workflows/ci.yml/badge.svg" alt="CI"></a>
  <a href="https://github.com/mattybellx/Guardmarly/blob/main/LICENSE"><img src="https://img.shields.io/badge/license-custom%20terms-blue" alt="License"></a>
</p>

```bash
pip install guardmarly && guardmarly src/
```

---

## The problem

Authorization bugs — **IDOR, missing access controls, privilege escalation** — caused some of the largest data breaches in history. Most SAST tools can't find these bugs because they require tracing data from HTTP routes through auth guards into database queries.

## What Guardmarly does differently

```python
@app.route("/invoice/<id>")
def get_invoice(id):
    return Invoice.query.get(id)
    # ↑ CWE-639 IDOR: any user can view any invoice
    #   Bandit: silent. Semgrep OSS: silent. CodeQL: silent.
    #   Guardmarly: 🚨 CRITICAL — route flows to DB without auth check
```

Guardmarly maps every HTTP route, checks for auth guards, traces data flow to sinks, and flags the gap.

## Quick start

```bash
pip install guardmarly
guardmarly src/                          # text output
guardmarly src/ --format json -o r.json  # JSON report
guardmarly src/ --format sarif           # SARIF for GitHub
guardmarly --show-stats                  # lifetime + today counts
guardmarly --list-rules                  # full rule catalog
```

## Supported languages & CWEs

**5 full-AST languages:** Python, JavaScript/TypeScript, Go, Java, C#  
**35+ pattern-aware languages:** PHP, Ruby, Kotlin, Swift, Dart, Rust, Scala, Elixir, C/C++, Lua, and 25+ more  
**35+ CWE types:** IDOR (CWE-639), Missing Auth (CWE-862/306), SQLi (CWE-89), Command Injection (CWE-78), XSS (CWE-79), Path Traversal (CWE-22), SSRF (CWE-918), Deserialization (CWE-502), Hardcoded Secrets (CWE-798), Open Redirect (CWE-601), CSRF (CWE-352), XXE (CWE-611), and 25+ more.

> **Evidence**: See [CLAIMS_AND_EVIDENCE.md](CLAIMS_AND_EVIDENCE.md) for benchmark methodology, corpus details, and measured results. Detection rates vary by language and CWE category.

## Contributing

```bash
git clone https://github.com/mattybellx/Guardmarly.git
cd Guardmarly && pip install -e ".[dev]"
pytest tests/ -q                       # 1,183+ tests in ~12s
```

## License

See [LICENSE](LICENSE) for terms. Guardmarly is source-available software.
