0sec-labs/foxguard — Gitpedia

<img src="assets/logo.png" width="128" alt="foxguard" /> <h1 align="center">foxguard</h1> A fast security scanner. Completely free. 10+ languages supported. <a href="https://github.com/0sec-labs/foxguard/actions/workflows/ci.yml"><img src="https://github.com/0sec-labs/foxguard/actions/workflows/ci.yml/badge.svg" alt="CI" /></a> <a href="https://github.com/0sec-labs/foxguard"><img src="https://img.shields.io/badge/foxguard-clean-3fb950" alt="foxguard: clean" /></a> <a href="https://crates.io/crates/foxguard"><img src="https://img.shields.io/crates/v/foxguard?color=d97706&label=crates.io" alt="crates.io" /></a> <a href="https://www.npmjs.com/package/foxguard"><img src="https://img.shields.io/npm/v/foxguard?color=d97706&label=npm" alt="npm" /></a> <a href="https://github.com/apps/foxguard-app/installations/new"><img src="https://img.shields.io/badge/GitHub_App-Install-2ea44f?logo=github" alt="Install GitHub App" /></a>

sh
npx foxguard .

Features

Sub-second scans on real codebases -- fast enough for pre-commit hooks
Completely free -- local scans, CI usage, and GitHub PR checks without a paid tier
10+ languages supported -- JS/TS, Python, Go, Ruby, Java, PHP, Rust, C#, Swift, Kotlin, C
Cross-file taint tracking with intraprocedural dataflow and cross-file summaries
Diff scans -- only new findings since a target branch
Secrets scanning -- AWS keys, GitHub/GitLab/Slack/Stripe tokens, private keys
Dependency vulnerability scanning -- OSV-backed SCA for Cargo, npm, pnpm, pip, Poetry, and Pipenv lockfiles
Post-quantum crypto audit -- CNSA 2.0 migration deadlines on every finding
Semgrep/OpenGrep-compatible YAML bridge -- load external rule packs via --rules
Interactive TUI -- triage, baseline, ignore, severity overrides
Output formats -- terminal, JSON, SARIF, CycloneDX 1.6 CBOM
GitHub App -- auto-scans PRs, posts inline comments, check runs

Install

sh
npx foxguard .                                      # zero install
curl -fsSL https://foxguard.dev/install.sh | sh     # prebuilt binary (macOS/Linux)
cargo install foxguard                              # from source

Prebuilt installs verify release SHA-256 checksums before using downloaded
binaries. Signed GitHub artifact attestations are published for release binaries;
see release provenance for manual verification.

GitHub Action:

yaml
- uses: 0sec-labs/foxguard/action@v0.9.0
  with:
    path: .
    severity: medium
    fail-on-findings: "true"
    upload-sarif: "true"

The action verifies the downloaded binary against checksums.txt. Provenance
verification is available as a separate gh attestation verify policy step.

pre-commit:

yaml
repos:
  - repo: https://github.com/0sec-labs/foxguard
    rev: v0.9.0
    hooks:
      - id: foxguard

VS Code: Install extension -- scans on save, inline findings.

Claude Code: claude --plugin-dir ./plugins/claude-code -- see docs.

MCP server: foxguard-mcp exposes scan, diff, secrets, PQC, SARIF/CBOM,
rule, explanation, and suppression tools -- see docs.

Quick start

sh
foxguard .                    # scan everything
foxguard diff main .          # only new findings vs main
foxguard secrets .            # leaked credentials and keys
foxguard sca .                # dependency vulnerabilities from OSV
foxguard pqc .                # post-quantum crypto audit
foxguard tui .                # interactive triage UI
foxguard --format sarif . > results.sarif   # SARIF for CI

GitHub App

Scans every pull request automatically. Posts inline comments on new findings and reports check run status. Zero config -- install and it works.

Supported languages

Language	Taint tracking	Framework-aware
JavaScript / TypeScript	Yes	Express, Next.js
Python	Yes	Django, Flask, FastAPI
Go	Yes	Gin
Kotlin	Yes	Spring
Java	--	Spring
Ruby	--	Rails
PHP	--	Laravel
Rust	--	--
C#	--	.NET
Swift	--	iOS
C	--	via Semgrep YAML / Coccinelle

Post-quantum crypto audit

sh
foxguard pqc .

src/tls/client.go
  42:14  HIGH  go/pq-vulnerable-crypto (CWE-327)
         ECDH P-256 is not post-quantum safe.
         CNSA 2.0 deadline: traditional networking equipment, 2030.

Each finding carries its CNSA 2.0 migration deadline. Covers Python, JS/TS, Go, Java, Rust, and TLS config files. Export as CycloneDX 1.6 CBOM with --format cbom.

Dependency vulnerability scanning

sh
foxguard sca .
foxguard --sca . --format json
foxguard sca . --sca-offline --sca-db ./osv-advisories.json

SCA supports Cargo.lock, package-lock.json, pnpm-lock.yaml, requirements.txt, poetry.lock, and Pipfile.lock. Offline mode uses --sca-db or an existing --sca-cache; without either, OSV lookup is skipped and normal/PQ manifest rules still run. See docs/dependency-scanning.md.

Configuration

foxguard auto-discovers .foxguard.yml from the scan path upward.

yaml
scan:
  baseline: .foxguard/baseline.json
  disable_rules: [py/no-eval]
  severity_overrides:
    py/no-hardcoded-secret: medium

secrets:
  exclude_paths: [fixtures, testdata]