What is GuardRails

GuardRails makes open-source security tools easily available in your GitHub Pull Requests. GuardRails has a unique and very opinionated take on security. It has been tuned to keep the noise low and only report high-impact and relevant security issues.

Installing and configuring security tools, even for one repository, typically takes a lot of time and effort. GuardRails makes that process painless, quick and rewarding for developers.

GuardRails can be installed across all your repositories in minutes. Once installed, GuardRails identifies security problems in your codebase and helps you fix them.

To see the list of security tools that are integrated into GuardRails, go to the Tools page.

With GuardRails, you can move fast and be safe.

Language Support

GuardRails is currently supporting a variety of languages including Python, Ruby, JavaScript, Go, and Solidity. If you are looking for a language that we do not support at the moment, please drop us a line at support@guardrails.io.

Report

A usual report based on what we found will look like this: Example Report

Source Code Analysis

Our static code analysis engine allows us to detect a range of security issues:

  • Insecure Use of SQL Queries
  • Insecure Use of Dangerous Function
  • Insecure Use of Regular Expressions
  • Insecure Authentication
  • Insecure Access Control
  • Insecure Configuration
  • Insecure File Management
  • Insecure Use of Crypto
  • Insecure Use of Language/Framework API
  • Insecure Processing of Data
  • Insecure Network Communication

Dependency Analysis

The engines use public available vulnerability data. It provides feedback on the status of your current dependency tree. Reports are only created for high severity issues that have an impact on your codebase.

Hard-Coded Secrets

Our secret detection engines identify several types of hard-coded secrets in your code:

  • Private Keys
  • High Entropy Strings
  • Basic Authentication Strings