GitHub - xiaohou2503687-design/guardrail: One-command security scanner. 40+ rules for secrets, OWASP and deps. Scanned React: F grade. · GitHub
/" data-turbo-transient="true" />
Skip to content
Search or jump to...
Search code, repositories, users, issues, pull requests...
-->
Search
Clear
Search syntax tips
Provide feedback
--><br>We read every piece of feedback, and take your input very seriously.
Include my email address so I can be contacted
Cancel
Submit feedback
Saved searches
Use saved searches to filter your results more quickly
-->
Name
Query
To see all available qualifiers, see our documentation.
Cancel
Create saved search
Sign in
/;ref_cta:Sign up;ref_loc:header logged out"}"<br>Sign up
Appearance settings
Resetting focus
You signed in with another tab or window. Reload to refresh your session.<br>You signed out in another tab or window. Reload to refresh your session.<br>You switched accounts on another tab or window. Reload to refresh your session.
Dismiss alert
{{ message }}
xiaohou2503687-design
guardrail
Public
Notifications<br>You must be signed in to change notification settings
Fork
Star
main
BranchesTags
Go to file
CodeOpen more actions menu
Folders and files<br>NameNameLast commit message<br>Last commit date<br>Latest commit
History<br>9 Commits<br>9 Commits
bin
bin
docs
docs
src
src
.gitignore
.gitignore
LICENSE
LICENSE
PROJECT-ASSESSMENT.md
PROJECT-ASSESSMENT.md
README.md
README.md
package-lock.json
package-lock.json
package.json
package.json
View all files
Repository files navigation
棣冩礉閿?GuardRail
One-command security scanner for indie projects. Find secrets, OWASP vulns, and bad deps before they find you.
npx guardrail scan
棣冩Ш The Problem
Every week, indie developers accidentally push API keys to GitHub. 90% of solo projects have zero security scanning. One leaked key = one drained AWS bill.
GuardRail fixes this. One command. No config. No SaaS BS.
閳?Quick Start
# Scan your project<br>npx guardrail scan
# Scan a specific directory<br>npx guardrail scan --path ./my-app
# Export a Markdown report<br>npx guardrail report
# JSON output for CI/CD<br>npx guardrail scan --json
棣冩敵 What It Scans
Scanner<br>What It Finds<br>Rules
棣冩斀 Secrets<br>AWS keys, GitHub tokens, Stripe keys, OpenAI/Claude/DeepSeek API keys, Slack webhooks, DB URLs, private keys<br>15 regex rules
棣冩憹 Dependencies<br>npm audit + 30+ known CVEs (lodash, axios, next, vite, express...)<br>Built-in vuln DB
棣冩偘 OWASP<br>XSS, SQL injection, eval(), command injection, insecure CORS, debug mode<br>15 patterns
閳挎瑱绗?Config<br>.gitignore gaps, Docker :latest, .npmrc tokens, YAML secrets<br>6 checks
棣冩惓 Example Output
閳烘柡鏅查埡鎰ㄦ櫜閳烘劏鏅查埡鎰ㄦ櫜閳烘劏鏅查埡鎰ㄦ櫜閳烘劏鏅查埡鎰ㄦ櫜閳烘劏鏅查埡鎰ㄦ櫜閳烘劏鏅查埡鎰ㄦ櫜閳烘劏鏅查埡鎰ㄦ櫜閳烘劏鏅查埡鎰ㄦ櫜閳烘劏鏅查埡鎰ㄦ櫜閳烘劏鏅查埡鎰ㄦ櫜閳烘劏鏅查埡鎰ㄦ櫧<br>閳? 棣冩礉閿? GuardRail Security Scan Report 閳?閳烘埃鏅查埡鎰ㄦ櫜閳烘劏鏅查埡鎰ㄦ櫜閳烘劏鏅查埡鎰ㄦ櫜閳烘劏鏅查埡鎰ㄦ櫜閳烘劏鏅查埡鎰ㄦ櫜閳烘劏鏅查埡鎰ㄦ櫜閳烘劏鏅查埡鎰ㄦ櫜閳烘劏鏅查埡鎰ㄦ櫜閳烘劏鏅查埡鎰ㄦ櫜閳烘劏鏅查埡鎰ㄦ櫜閳烘劏鏅查埡鎰ㄦ殕
Security Score: 72/100 Grade: C
2 CRITICAL 3 HIGH 5 MEDIUM 1 LOW
棣冩斀 Secrets & Credentials (2)<br>棣冩暥 CRITICAL .env<br>AWS Access Key ID exposed<br>棣冩暥 CRITICAL src/config.js:15<br>Stripe Live Secret Key exposed
棣冩憹 Dependencies (3)<br>棣冩暥 CRITICAL next@14.0.0<br>Server-Side Request Forgery (CVE-2024-46995)<br>Fix: Update to next@^14.2.15
棣冩尩 Pricing
Plan<br>Price<br>Features
Free<br>$0 forever<br>CLI scanner, all 40+ rules, terminal report
Pro<br>$12/mo<br>CI/CD integration, history tracking, AI fix suggestions
Lifetime<br>$99 once<br>Everything in Pro, forever
棣冩啝 Buy Pro / Lifetime
棣冨皞 Why GuardRail?
Zero config 閳?works on any project instantly
40+ detection rules 閳?secrets, OWASP, deps, config
Offline-first 閳?no data sent anywhere
Open source 閳?MIT license, audit the code yourself
CI/CD ready 閳?--json flag for GitHub Actions
棣冾檪 Sponsors & Support
鐚?Star this repo if you find it useful!
Built with 閴傘倧绗?by chunfeng3681 | MIT License
🧰 More Tools
💰 PayFlow — Stripe analytics for indie hackers
🔍 SEOmatic — AI content cluster generator
🚀 ShipFast — One-command deploy
About
One-command security scanner. 40+ rules for secrets, OWASP and deps. Scanned React: F grade.
Topics
cli
security
scanner
secrets
owasp
Resources
Readme
License
MIT license
Uh oh!
There was an error while loading. Please reload this page.
Activity
Stars
stars
Watchers
watching
Forks
forks
Report repository
Releases
v0.1.0 - Initial Release
Latest
Jun 22, 2026
Packages
Uh oh!
There was an error while loading. Please reload this page.
Contributors
Uh oh!
There was an error while loading. Please reload this page.
Languages
JavaScript<br>100.0%
You can’t perform that action at this time.