pgard

Open source · MIT · pre-release

Scan your own code before anyone else does.

Security scanner for your own projects — code, Git history and your local web app, checked on your machine. It only scans GitHub repositories you are authorized for, checks that again on every scan, and never uploads your code or results.

Install

npm install -g pgard

pre-release First release coming soon — build from source today.

git clone https://github.com/JadenMeister/pgard.git && cd pgard && npm ci && npm run build

Star on GitHub Read the docs What it does not do

01

How it works.

Three steps, all from your terminal.

  1. Install

    From npm or Homebrew.

    First release coming soon. Build from source today.

    npm install -g pgard
    git clone https://github.com/JadenMeister/pgard.git cd pgard npm ci npm run build

  2. Sign in and authorize

    Sign in to GitHub once with the device flow. The owner installs the PGARD GitHub App; PGARD then checks five things and tells you what is missing.

    pgard login pgard project verify

  3. Scan locally, view the results

    Code and Git history are scanned on your machine. Read the result in the terminal, in a full-screen panel view, or in the local dashboard.

    pgard scan --panels pgard dashboard

02

See it.

Real output from a build of this repository. Pick a view.

pgard --help 
$ pgard --help
pgard - local security checks for GitHub projects you are authorized to scan

Usage:
  pgard                         interactive menu (arrow keys, Enter, Esc, ?)
  pgard project verify          check repository, GitHub identity, owner approval,
                                current access and merged contribution
  pgard scan                    code and configuration + Git history
  pgard scan code               current code and configuration
  pgard scan history            Git history and tracked files (secrets, risky files)
  pgard scan web [--port N]     anonymous read-only checks of a local HTTP service
  pgard scan all [--port N]     code + history + local HTTP service
  pgard dashboard [--target-port N]
                                start the local web dashboard
  pgard rules list [--language js|ts|react|vue|go|java|kotlin] [--lang en|ko]
                                supported rules and unsupported areas
  pgard history clear --all | --repo owner/name
                                delete stored scan results (all, or one repository)
  pgard baseline set [--from-current] | show | clear
                                keep a scan as this repository's baseline; later
                                scans list matching findings under "In baseline"
  pgard doctor                  diagnose the environment (not an authorization)
  pgard advisories update       download public OSV vulnerability data (npm, Go)
                                to this computer; the only non-GitHub download
  pgard login                   sign in to GitHub once and save it in the OS keychain
  pgard logout                  remove the saved GitHub sign-in from the OS keychain
  pgard --help | <command> --help
  pgard --version

The target is always the Git root of the current directory. Every scan re-runs the
authorization gate; only the GitHub sign-in is reused. Code and results are
processed locally; PGARD contacts GitHub for sign-in and repository metadata only.
GitHub pages open in the browser automatically when stdout is a terminal; pass
--no-browser to scan, project verify, login or dashboard to only print the links.

Exit codes:
  0    requested scope completed (findings may exist)
  2    invalid command, option or value
  3    repository, authorization or contribution check failed
  4    part of the scan or the report export failed
  5    internal error
  130  cancelled
  143  terminated by SIGTERM while the panel view was open

Help and rules list are real output of the built CLI (offline, no sign-in). The scan result and panel view come from the repository's own test snapshots: fixture data for a placeholder project, shortened with ... where noted. They are not a scan of a real repository.

03

Features.

What is in the box today. Each line matches the README.

Code, history, local web

Three scan areas, chosen per scan. Every result says what was and was not checked.

Languages

JavaScript, TypeScript, React, Vue and Go. Java and Kotlin for SQL, command and path rules. Python and PHP are not analyzed yet.

OWASP, CWE, CERT

Rules map to OWASP Top 10 2025 and CWE Top 25 2025, and to SEI CERT Java rules where one applies. The map never says “safe”.

SARIF, JSON, HTML, PDF

Machine-readable output for scripts and code scanning, and reports you can read or share. Rule texts and report headings in English or Korean; scan evidence stays English.

CLI panels

pgard scan --panels opens a read-only full-screen view in your terminal: overview, charts, coverage, findings.

Local dashboard

pgard dashboard starts a local web dashboard on 127.0.0.1 with a private session token. It is not hosted anywhere.

Baseline and history

Keep a scan as the baseline and later scans highlight what is new. Stored results stay on your computer and can be deleted.

Incremental scans

A repeat scan only looks at what changed and says so in the result. --full scans everything again.

Authorization gate

Five checks run again before every scan. There is no option to skip them.

04

What it checks.

Three areas, picked per scan, and what runs depends on the language. Run pgard rules list for the full catalog.

code

Code

Current source code and configuration.

  • SQL injection, XSS, SSRF, OS command execution and path traversal
  • Weak or hardcoded cryptography, plaintext passwords, cookie flags, CSRF, missing rate limiting on login routes
  • Walks the working tree; build output and dependency directories are skipped and listed

history

Git history

Committed secrets, past and present.

  • Committed .env files
  • Secrets in tracked files and secrets that only exist in history
  • Secret values are redacted in every output

web

Your local web service

Only a service you run on 127.0.0.1, and only after you confirm it.

  • Anonymous GET and HEAD requests only, no form submissions
  • Security headers, cookie flags, CORS with credentials, version disclosure, directory listing, exposed /.env and /.git
  • Limits: 20 pages, depth 2, 5 s per request, 60 s total

Languages and categories

Language Categories
JavaScript, TypeScript SQL injection, XSS, SSRF, command execution, path traversal, cryptography, password storage, cookies, CSRF, rate limiting
React, Vue XSS in dangerouslySetInnerHTML and v-html, plus the JavaScript and TypeScript rules
Go SQL injection (database/sql, GORM), command execution, path traversal, SSRF, cryptography, cookies
Java, Kotlin Only three categories: SQL injection, command execution and path traversal (also MyBatis mapper XML). Nothing else is checked yet.
Python, PHP Detected, not analyzed yet. The coverage shows them as not tested.

The standards map shows rules ran, rules partial, not run or no rules for each OWASP Top 10 2025 category and CWE Top 25 2025 entry. It never says safe, and nothing is shown in green.

05

Integrations and outputs.

PGARD writes files and streams. Where they go is your decision; PGARD uploads nothing.

SARIF to code scanning

SARIF 2.1.0 on stdout. After a local scan that exits 0, upload it to GitHub code scanning yourself, for example with gh api; the README shows the exact command. There is no CI workflow, because a CI runner cannot pass the authorization gate. Never upload after exit code 3, 4 or 5: a partial scan would close alerts for areas that were never checked. README: SARIF output

pgard scan --format sarif > pgard.sarif

JSON for scripts

Only the redacted result goes to stdout; progress and prompts go to stderr, so the file is valid JSON. The schema is documented and versioned. Result schema

pgard scan --format json > result.json

HTML and PDF reports

Redacted reports in English or Korean (scan evidence stays English), written to an existing folder you choose. Existing files are never overwritten.

pgard scan --report both --output-dir ./reports

06

Authorization first.

PGARD scans a repository only when it has evidence that you are allowed to.

Five checks run before every scan, in the CLI and in the dashboard. There is no option to skip them and no cached approval. If any evidence is missing or unclear, the scan is blocked (exit code 3) and PGARD says which check failed and why.

  1. RepositoryThe current directory is a Git repository root with valid history and one unambiguous github.com remote.
  2. GitHub identityYou sign in with the GitHub device flow, or reuse the sign-in saved in your OS keychain.
  3. Owner approvalThe PGARD GitHub App is installed by the owner of the repository. For an organization, you must be an active owner.
  4. Current accessGitHub says you currently have at least read access.
  5. ContributionOwners are exempt from proving a contribution, but local history must still share a commit with the default branch. Everyone else needs a merged pull request or a verified signed commit.

Why it exists.

PGARD is for people checking their own projects. A security scanner is also a tool for probing other people's code, so PGARD refuses to run on anything it cannot tie to you and to the owner's approval, every time, and tells you how to fix a blocked state.

The GitHub App.

Sign-in uses the PGARD GitHub App through the device flow; the app ships its public client id and PGARD has no client secret. Installing the App on the owner account is the owner's approval, and PGARD can never do it for you. If that is the only thing missing, PGARD prints the install link, waits up to 10 minutes, then runs all five checks again from scratch.

07

Local-first.

Your code, history and results are processed on your computer.

Stays on your machine

  • Source code, Git history and scan results
  • Stored results: your last 20 scans per repository for 90 days, with owner-only permissions on macOS and Linux. Opt out with --no-store, delete with pgard history clear --all
  • Your GitHub sign-in, kept in the OS keychain and never written to a file or printed
  • Reports you export, saved only where you choose

Goes over the network

  • GitHub, during scans: sign-in and the metadata needed for authorization (your identity, the App installation, organization membership, your access, your contributions). To check contribution, PGARD sends the SHAs of local commits
  • The OSV export host, only when you run pgard advisories update yourself: a download of public vulnerability data. Nothing is uploaded
  • Loopback only: one GET / to each local port after authorization passes, to show you its identity

This website (pgard.dev) is static pages only. It does not scan anything, collect data, or offer sign-in or upload. It is not the dashboard: the dashboard runs on your computer.

08

Honest limits.

Short and frank. PGARD is pre-release.

09

Who it is for.

People who own the code they scan.

Solo developers, before a push

Scan the working tree and Git history of your own project, including uncommitted files. A repeat scan only re-reads what changed.

Teams reviewing their own repositories

Keep a baseline so new findings stand out, and upload SARIF to code scanning yourself after a local scan. An organization repository can be scanned by an organization owner.

Learning secure coding

Each finding comes with its location, redacted evidence, a fix, and links to the OWASP, CWE and CERT entries it maps to.

10

Free and open source.

There is no pricing section because there is nothing to price.

Read the sourceMIT License

11

Install.

Node.js 22.23.4, 24.22.1 or 26.12.1 (or a newer patch), Git, on macOS, Linux or Windows.

npmNot published yetAvailable

npm install -g pgard
npx pgard doctor
npm install -g pgard npx pgard doctor

Available after the first release; shown here for reference, not copyable. Until then, npm install -g pgard installs only a placeholder package with no pgard command.

HomebrewNot published yetAvailable

brew tap jadenmeister/pgard brew install pgard
brew tap jadenmeister/pgard brew install pgard

Or in one line: brew install jadenmeister/pgard/pgard

The tap is created with the first release; these commands are shown for reference until then.

Build from sourceWorks today

git clone https://github.com/JadenMeister/pgard.git cd pgard npm ci npm run build

Optional: npm link -w @pgard/cli puts pgard on your PATH. Otherwise run node apps/cli/dist/bin/pgard.js.

First run

Run these from the root of the project you want to scan.

pgard doctor pgard login pgard project verify pgard scan

12

FAQ

Does my code leave my machine?

No. Code, Git history and results are processed on your computer and are not uploaded. During scans PGARD contacts GitHub only, for sign-in and the metadata needed for authorization (including the SHAs of local commits, to check contribution). The one other destination is the OSV export host, and only if you run pgard advisories update yourself: it downloads public data and uploads nothing.

Why does it need a GitHub sign-in?

To prove you are allowed to scan. PGARD checks your GitHub identity, that the owner installed the PGARD GitHub App, that you currently have access and that you own the repository or contributed to it. The token is kept in your OS keychain, never in a file.

Which repositories can I scan?

Your own repositories, once the PGARD GitHub App is installed on your account (PGARD guides you through it). Someone else's personal repository only if its owner installed the App and you have current read access plus a merged pull request or a verified signed commit on the default branch. Organization repositories only if you are an active owner of the organization and the App is installed with access to the repository. Remote repositories are never scanned: the target is always the Git root of your current directory.

Is a clean result proof that my project is safe?

No. Findings are signals, detection is not complete, and no findings does not mean secure. Every result lists what was not checked, and the standards map shows how few weaknesses in a category have a rule at all.

What about Python and PHP?

Python and PHP files are detected but not analyzed yet; the coverage shows them as not tested. Java and Kotlin are checked for SQL injection, command execution and path traversal only.

Does it run on Windows?

Yes. macOS, Linux and Windows are supported and CI runs the full test suite on all three. On Windows the sign-in is kept in Credential Manager. The old console window (legacy conhost) and visual rendering have not been verified by a user.

Can I use it in CI?

Not today. Every scan needs a GitHub sign-in that a CI runner does not have, so a runner would produce a blocked result. What works: run PGARD locally and read --format json or --format sarif and the exit codes (0 completed, 3 blocked, 4 partial) in your own scripts.

How is it different from a hosted scanner?

PGARD runs on your computer and uploads nothing, so your code is not copied to a service. The trade-offs are that you run it yourself, there is no hosted dashboard or continuous monitoring, and it asks GitHub whether you are allowed to scan.

Does it check dependencies for known CVEs?

Not yet. PGARD ships no vulnerability database and does not match dependency versions against advisories. It can read lockfiles and download public OSV data on request, which is groundwork for a later check.

How do I report a vulnerability in PGARD?

Privately, not in a public issue. Use the Report a vulnerability button on the repository's Security tab. See the security policy for the scope. There is no bug bounty.

13

Where it is going.

Themes, not promises. There are no dates, and plans change.

Browse open issues

14

Community and contributing.

PGARD is developed in the open on GitHub. There is no newsletter and no backend; GitHub is the place to follow along.