Guardmarly for VS Code

Guardmarly catching CWE-22 path traversal in VS Code

SAST scanner inline in your editor. Detects IDOR, missing authorization, SQL injection, XSS, path traversal, and 30+ more CWE types — runs locally on your machine.

Features

🔍 Real-time scanning — findings appear inline as you type
🛡️ IDOR detection — catches authorization bugs other tools miss
📊 Trace-backed findings — see the full taint path from source to sink
🌐 5+ languages — Python, JavaScript/TypeScript, Go, Java, C#, and 35+ more
📋 SARIF output — one-click export for GitHub Code Scanning
🔒 Runs locally — scans files on your machine, no cloud required
⚡ Auto-detects guardmarly CLI — works with pip, pipx, or python -m

Installation

Install from the VS Code Marketplace or:

code --install-extension guardmarly.guardmarly

Usage

Open any Python, JavaScript, Go, Java, or C# file
Guardmarly scans automatically on open and on save
Findings appear as inline diagnostics with severity badges
Run Guardmarly: Scan workspace from the command palette for a full scan

Settings

Setting	Default	Description
`guardmarly.enabled`	`true`	Enable/disable scanning
`guardmarly.failOn`	`"high"`	Minimum severity to highlight

Commands

Command	Description
`Guardmarly: Scan file`	Scan the active file
`Guardmarly: Scan workspace`	Scan all files in the workspace

See CLAIMS_AND_EVIDENCE.md for benchmark methodology and measured results.

Guardmarly — Offline SAST Security Scanner