Guardrails automatically detects leaked secrets, known vulnerabilities, dangerous code patterns, and missing authentication — before code gets merged.
$ npx @guardrails-ai-sec/scanner scan
============================================================
Scan complete: 2 blocking, 1 warning, 14 files scanned
============================================================
BLOCK [secrets] AWS Access Key detected
src/config.ts:12
BLOCK [dependencies] CVE-2024-1234 in lodash@4.17.20
package.json:8
WARN [auth] Unauthenticated /admin route
src/routes/admin.ts:5Four categories of security issues, all running automatically on every PR.
AWS keys, GitHub tokens, Stripe keys, private keys, passwords, and 20+ patterns. Regex-based with low false positives.
Checks npm, pip, Go dependencies against the OSV database for known CVEs. Blocks PRs that introduce vulnerable packages.
SQL injection via string concatenation, eval(), command injection, insecure deserialization, and custom regex patterns.
Detects unprotected admin and sensitive routes in Express, Next.js. Ensures auth middleware is applied where needed.
One-click install from GitHub Marketplace. Select which repos to protect.
Guardrails automatically scans changed files and posts results as Check annotations.
Add .guardrails.yaml to configure rules, severity levels, allowlists and actions.
Scan your code before pushing. Same engine as the GitHub App, running directly on your machine.
Scan current directory
npx @guardrails-ai-sec/scanner scanScan specific path
npx @guardrails-ai-sec/scanner scan ./srcSARIF output for CI
npx @guardrails-ai-sec/scanner scan -o sarifGenerate policy file
npx @guardrails-ai-sec/scanner init-policy.guardrails.yaml
version: "1"
default_action: warn
rules:
secrets:
enabled: true
action: block
allowlist:
paths: ["**/*.test.*"]
dangerous_patterns:
enabled: true
action: warn
dependencies_osv:
enabled: true
action: block
auth_heuristics:
enabled: true
action: warn
frameworks: [express, nextjs]Free for open source. Affordable for teams.
After payment, send your GitHub username or organization name to ondys.dev@gmail.com and we'll activate your plan within 24 hours.