v6.5.0 — Now on PyPI

Find authorization bugs before attackers do

The only free SAST scanner with built-in IDOR detection. 100% CVE recall across 5 languages. Zero false positives on clean code. Fully offline.

Try Live Demo View on GitHub
invoice_api.py
from flask import Flask, request from models import Invoice app = Flask(__name__) @app.route("/invoice/<id>") def get_invoice(id): return Invoice.query.get(id) # ↑ CWE-639 IDOR: any user can view any invoice # Bandit: silent. Semgrep OSS: silent. CodeQL: silent. # Guardmarly: CRITICAL - route flows to DB without auth

What makes Guardmarly different

Most SAST tools pattern-match for injection flaws. Guardmarly traces data from HTTP routes through auth guards into database queries — catching the authorization bugs that caused real breaches.

Built-in IDOR Detection

Maps every HTTP route, checks for auth guards, and traces data flow to sinks. Catches CWE-639, CWE-862, and CWE-306 — the bugs Bandit, Semgrep OSS, and CodeQL miss.

🎯

100% CVE Recall

164/164 CVEs detected across all 5 supported languages. Zero false negatives on known vulnerability patterns. Industry-leading precision.

🔒

Fully Offline

Zero cloud dependencies. Zero API keys. Zero telemetry. Your code never leaves your machine. Deployable in air-gapped environments.

⚡

Sub-Second Scans

Rust-powered native parser core with tree-sitter. Scans 10,000+ LOC per second. Falls back gracefully to pure Python when needed.

🌐

5 Languages

Python, JavaScript/TypeScript, Go, Java, and C#. Each with dedicated AST-based analyzers — not regex hacks.

📋

SARIF + GitHub Integration

Native SARIF output for GitHub Code Scanning. One-line CI integration. PR comments with finding details and fix suggestions.

1183
Unit Tests Passing
100%
CVE Recall (164/164)
35+
CWE Types Detected
5
Languages Supported
{{ counter.total_scans }}
Live Demo Scans
{{ counter.total_repos }}
Repos Scanned

Vulnerabilities detected

35+ CWE types across injection, authorization, cryptography, and configuration categories.

CWE-639

IDOR

Insecure Direct Object Reference — route params flow to DB without ownership check

CWE-89

SQL Injection

Dynamic SQL construction with user-controlled input

CWE-78

Command Injection

Shell command construction with tainted data

CWE-79

Cross-Site Scripting

Unescaped user data in HTML rendering sinks

CWE-22

Path Traversal

User-controlled paths reaching filesystem operations

CWE-918

SSRF

User-controlled URLs in outbound HTTP requests

CWE-502

Deserialization

Untrusted data fed to pickle, yaml.load, or marshal

CWE-798

Hardcoded Secrets

API keys, tokens, and passwords in source code

CWE-862

Missing Authorization

Endpoints without authentication or access control checks

Supported languages

🐍 Python 📜 JavaScript 🔷 TypeScript ☕ Java 🐹 Go 🔮 C#

Try it live

Paste some code and see what Guardmarly finds. No install required.

Simple pricing

Start free. Upgrade when you need advanced features.

Free
$0/forever
  • Unlimited local scans
  • All 5 languages
  • 35+ CWE types
  • Text & JSON output
  • Community support
pip install guardmarly
One-Time
£4.99/once
  • Everything in Free
  • 30 days Pro access
  • SARIF output for GitHub
  • HTML dashboards
  • SBOM generation (CycloneDX)
Get One-Time £4.99
Pro
£49/year
  • Everything in One-Time
  • Unlimited Guarded Autofix
  • Priority support
  • Early access to new features
  • Commercial use license
  • Lifetime updates
Get Pro £49/yr