PullGuard — SAST Code Security, Quality & Compliance on Every PR

🔒

Code stays on your runners

Docker container on your own GitHub Actions runners. Source code is never transmitted, stored, or seen by PullGuard servers. Data-residency and air-gapped-friendly by design.

📋

8 compliance frameworks

SOC 2 (8 controls), HIPAA Technical Safeguards, PCI DSS 4.0, NIST 800-53 Rev 5, ISO 27001:2022 — a PASS / CONCERN / FAIL rollup per framework on every PR, with full per-control tables (AICPA / NIST citation text) opt-in via compliance: in .driftrc.yml. Plus three opt-in AI-era frameworks — EU AI Act, ISO/IEC 42001, NIST AI RMF — as evidence supporting those obligations (advisory, not certification).

🎯

High signal, not noise

Every finding is built to be actionable — findings split actionable vs observational, and false positives are treated as bugs: closed structurally with regression tests. 4,000+ automated tests back every claim on this page; CI rejects marketing drift. OWASP Top 10 coverage validated on a runnable 18-fixture corpus modeled on Semgrep Pro's documented detections — 18/18 detected, re-run on every build.

📄

Procurement-ready

Business Source License 1.1 → Apache 2.0 in 2030. Enterprise MSA with reverse-engineering prohibition + DPA. 4 business-hour response SLA for Enterprise; SSO (SAML / OIDC) and RBAC included. Tamper-proof audit logs & export on the roadmap.

v1.5.3

Attacks aimed at your AI coding assistants — caught in review

The files and comments your coding agents read are now part of the review surface: hidden instructions, planted directives, and weaponized agent configuration — flagged before they reach a developer's editor.

v1.5.4 — precision, anti-evasion & AI provenance: the full customer-evaluation precision queue is closed (query-builder/prose false positives, timing-attack confirm fields, MD5 content digests, vendored assets), with every fix verified against the customer's own fixtures. Scanner integrity hardened: a pull request can no longer exclude its own files from scanning, renamed agent/MCP configs no longer evade detection, and a padded line can no longer hide security findings. Detection deepened: fetched remote content written into the DOM is caught end-to-end (including DOMParser round-trips), and sanitizers now clear only the vulnerability classes they actually mitigate — an HTML encoder no longer hides SQL-injection or request-forgery flows. New opt-in AI-authorship provenance evidence: comment markers, git commit trailers, and C2PA/Content-Credentials manifests on committed assets (EU AI Act Art. 50 transparency evidence). Verified with no loss of detection coverage.
v1.5.3 — comment-level injection & agentic risk mapping: source-code comments — context every AI coding assistant reads — are now inspected for two attack classes seen in the wild this year: invisible Unicode control characters hidden in comments, and comment blocks addressed to AI assistants carrying override, concealment, or exfiltration directives. Detection is comment-aware — it distinguishes code from comments and is tuned to reduce false positives on ordinary comments that merely mention AI tools — so findings reflect override, concealment, or exfiltration directives rather than incidental mentions. Calibrated against two dozen real open-source repositories before release. Agentic-risk findings now also carry their OWASP Top 10 for Agentic Applications category in SARIF output, so they can be filtered and reported against the published taxonomy in GitHub Code Scanning. Verified with no loss of detection coverage.
v1.5.2 — agent worm surface: the scanner now inspects hook commands committed in agent settings files and editor tasks configured to run automatically when a folder is opened — the surfaces weaponized by this year's self-propagating package-worm campaigns to run credential-stealing payloads the moment a developer opens a cloned repository. Hidden-instruction detection widened to a further class of invisible Unicode, dependency CVEs now resolve through yarn and pnpm lockfiles, and Security-tab findings are ranked by severity.
v1.5.1 — precision & triage usability: dependency CVEs are evaluated against the lockfile-resolved version — no more false criticals on already-patched dependencies, and a vulnerable resolution under a clean version range is now caught. A broad security-precision pass sharpens framework query-builder, SSRF, timing-attack, and secret detection on real-world code. New opt-in dev-tooling tiering down-ranks findings in build/preview tooling one severity step (annotated, never dropped — committed credentials keep full severity). The self-hosted server adds triage without an identity provider (opt-in, still audit-logged) and shows the assigned quality-gate verdict on the triage page. Light is now the default theme. Verified with no loss of detection coverage.
v1.5.0 — AI-agent security: a new analyzer inspects the configuration that drives coding agents and MCP servers — agent instruction files, MCP server definitions, editor/agent rule files, and agent hook scripts — for hidden-instruction attacks and backdoored tool definitions. New checks flag over-privileged agent tools, disabled human-approval gates, unbounded agent budgets, unauthenticated MCP servers exposed on the network, and unisolated retrieved-context (RAG) injection. Prompt-injection coverage is substantially wider, and a broad false-positive pass sharpens precision. Verified with no loss of detection coverage.
v1.4.6 — broader AI coverage: prompt-injection and sensitive-data-to-model detection now recognises much more of the AI SDK surface teams use today — current client and streaming call styles, structured-response APIs, composed chains, agent frameworks, managed cloud model services, and the mainstream Java AI stack. More AI provider credentials are recognised as secrets, and model calls routed through an OpenAI-compatible gateway are attributed to the real provider. Verified with no loss of detection coverage (OWASP Benchmark results unchanged).
v1.4.5 — precision & signal quality: sharper framework query-builder analysis and much less structural noise on large real-world codebases — parallel model boilerplate folds into a single observation, and test scaffolding is no longer judged as if it were shipped code — with no loss of detection coverage (verified against the OWASP Benchmark and a suite of deliberately-vulnerable apps).
Self-hosted control plane: the customer-hosted server adds server-administered quality-gate policy (enforced in CI), GitHub / GitHub Enterprise sign-in with team-based access, and an AWS ECS (Fargate) deployment option alongside Helm.
AI usage / Shadow-AI inventory: lists every external AI-provider call site in your codebase and flags where secrets or PII are exposed to it.
AI Bill of Materials: --format ai-bom emits a CycloneDX ML-BOM of the AI/ML components you depend on.
AI-provider key detection & AI-era security checks: prompt injection, secrets/PII flowing into LLM prompts, unsafe model deserialization, unbounded agent loops, and disabled AI safety filters.
Opt-in AI-era compliance frameworks: EU AI Act, ISO/IEC 42001, and NIST AI RMF — advisory evidence supporting those obligations (never a certification).
Verifiable supply chain: the published scanner image is now cosign-signed (keyless Sigstore, verifiable in the public Rekor transparency log), on top of SLSA build provenance and an SBOM — verify how it was built and what it contains with cosign verify and docker buildx imagetools inspect.

Full changelog →

Analyzers

Compliance Frameworks

4,000+

Tests Passing

Languages with Taint Tracking

CVE Ecosystems

Languages Detected

✓ Every capability claim on this page is backed by a runnable test. Verify any of it in CI — not marketing copy, auditable code.

Six categories of risk, one scan

Security, AI-era threats, supply chain, compliance, code quality, and cost — caught automatically on every pull request, with file, line, severity, and remediation steps. No new tools to wire up, no findings wall: just what to fix and what it's worth.

🔒

Security (15 OWASP Checks)

AI application security (OWASP LLM & Agentic Top-10) — data-flow tracked across AI and agent features (hosted, private & self-hosted models); agentic findings map to 8 of the 10 ASI categories — the two runtime-behavioural categories have no static code shape, and we don't claim them
SQL injection, XSS, SSRF, command injection, path traversal
Cross-file, inter-procedural taint tracking across 7 languages (JS/TS, Python, Java, C#, Go, Rust)
Unsafe-deserialization detection
XXE, CORS / CSP misconfiguration
NoSQL injection (MongoDB / Mongoose)
SSTI, unsafe reflection, file-upload validation, JWT confusion, cookie security
Custom taint sources & sinks via YAML — model your framework's request entry points & sinks, including proprietary CMS / internal APIs
Exploit-aware dependency CVEs across 5 ecosystems (npm, PyPI, Maven/Gradle, Go, RubyGems) — EPSS exploit-probability + CISA KEV "actively exploited" flag surface what attackers actually target
Continuous threat intel, no upgrade required — the CISA KEV exploited-vulnerability feed refreshes every few hours, so a newly-exploited CVE reaches your scans within hours, not on a release cycle. Air-gapped? The full CVE database imports offline for zero-egress scanning.

📋

Compliance Evidence (8 Frameworks)

SOC 2 — 8 controls (CC3.1, CC3.2, CC4.1, CC6.1, CC6.2, CC6.7, CC6.8, CC8.2)
HIPAA Technical Safeguards (45 CFR §164.312)
PCI DSS 4.0 + NIST 800-53 Rev 5 + ISO 27001:2022
AI-era (opt-in): EU AI Act, ISO/IEC 42001, NIST AI RMF — evidence supporting the obligation, never a certification or compliance grant
PASS / CONCERN / FAIL per control with AICPA / NIST citation text
Per-PR posture delta — "CC3.2 CONCERN→PASS ✅" continuous Type II monitoring
Risk register with remediation SLAs (7d critical, 30d major)

🎯

Endpoint Risk Engine

Composes auth × taint × reachability into a per-endpoint risk tier
/api/export · unauthenticated + tainted = critical
Auth-flow analyzer detects missing or weak authentication on identified endpoints
Reachability enrichment filters dead routes from triage
Severity discipline: Critical reserved for exploitable security only — not noise
Security findings cannot be suppressed at the analyzer level — auditor-defensible by design

🏗️

Code Quality

Honest line counts (NCLOC-aligned) — heavily-documented code is not penalised, unlike SonarQube
Per-language thresholds — Java 1000, Go 400, TS 600 (vs one-size defaults)
Cyclomatic + cognitive complexity
Dead code, unused exports, Type 1–3 clone detection
Monolithic file / function detection, deep nesting
Import cycles, layer violations, transitive cycle detection

🔗

Supply Chain & IaC

GitHub Actions security — unpinned actions, pwn-request, script injection, token over-permissions
Git-history secret scan — flags credentials committed then deleted
Dockerfile misconfig — runs-as-root, :latest tag, ADD-from-URL, embedded secrets
Dangerous tracked files — .env, .pem, id_rsa, serviceAccountKey.json
Kubernetes (CIS Level 1) — privileged pods, hostNetwork, missing resource limits
Repo hygiene — SECURITY.md / LICENSE / CODEOWNERS / CI workflow presence
Air-gapped CVE database for offline scanning

🤖

Secure & Govern AI-Written Code

AI × security composite — when code carrying an AI-era risk signal also has a real security flaw, one prioritized "human-review" finding instead of separate noise
AI-governance evidence — explicit AI-authorship provenance markers, as advisory evidence toward EU AI Act & NIST AI RMF (evidence toward, never a grant)
AI-era risk detection — prompt injection, secrets/PII flowing into LLM prompts, unsafe model deserialization, unbounded agent loops, disabled AI safety filters, hallucinated dependencies, insecure-by-default snippets
AI Bill of Materials — --format ai-bom emits a CycloneDX ML-BOM of the AI/ML components in your codebase
AI usage / Shadow-AI inventory — lists every external AI-provider call site and flags secret/PII exposure at each
Breaking change detection with caller blast radius
Knowledge silo risk (single-contributor files)
Test quality, flaky tests, type-coverage & dependency-freshness scoring

💰

Cost-of-Change Estimation

Dollar amounts per finding + category — configurable hourly rate
Actionable / Observational partition — header reads "47 actionable (+286 observations)" instead of inflated all-finding totals
Top 5 most expensive findings ranked inline
Total tech-debt cost surfaced for budget conversations
CFO-ready reports tied to remediation SLAs
Auditable suppression — /pullguard ignore <rule-id> opens a follow-up PR linking the original finding for audit trail

One tool replaces three

Most teams need Semgrep for SAST + SonarQube for quality + Snyk for CVEs. PullGuard combines all three.

✓ Parity corpus: 8 competitor categories, 73 runnable fixtures — OWASP Top 10 at 18/18 vs Semgrep Pro's documented detections

Capability	PullGuard	Semgrep	SonarQube	Snyk
OWASP Top 10 detection	15 checks	Pro ($)	Enterprise ($)	Yes
Inter-procedural taint	Cross-file	Pro ($)	Enterprise ($)	Yes
Code quality analysis	13 analyzers	No	Core	No
Dependency CVE scanning	5 ecosystems	No	No	Core
Cost estimation	$/finding	No	No	No
SOC 2 security evidence	8 controls	No	Enterprise ($)	No
Multi-framework compliance (SOC 2 / HIPAA / PCI / NIST / ISO 27001 + AI-era EU AI Act / ISO 42001 / NIST AI RMF)	8 frameworks	No	No	No
AI-era risk + AI×security composite	risk + composite	Partial†	No	Partial†
Committed agent & MCP config scanning (rules files, MCP servers, agent hooks, config drift)	Yes	No	No	No
AI Bill of Materials / AI usage inventory	AI-BOM + Shadow-AI	No	No	No
Signed images (cosign + SLSA + SBOM)	Yes	No	No	No
PR-delta / baselines (Clean as You Code)	Yes	Yes	Yes	Yes
Air-gapped reports & dashboard	Self-contained HTML	SaaS	Server	Cloud only
Self-hosted / air-gapped	Docker (static key required)	Yes	Yes	Cloud only

† Semgrep and Snyk each ship AI-security capabilities (real-time scanning of AI-written code; agent-workflow enforcement) — both LLM-assisted and metered. Neither statically scans the agent/MCP configuration committed in your repo, composes AI context with security findings, or maps findings to AI compliance frameworks — and neither can run with no LLM in the scan path. Capabilities reflect publicly documented offerings; last reviewed 2026-08-08.

Built for the enterprise buying center

PullGuard surfaces the right information for the right stakeholders — so procurement, security review, and rollout happen in parallel, not in sequence.

🛡️ For Security Leaders

OWASP Top 10 at parity with Semgrep Pro's documented detections (18/18 on our runnable corpus). Cross-file taint tracking across 7 languages. Pwn-request, script injection, and token over-permissions detection — top CI/CD supply-chain vectors. Dependency CVE scanning across 5 ecosystems, offline-capable. Replaces Semgrep + Snyk + StepSecurity + GitGuardian with one tool, one install, one invoice.

📊 For Engineering Leaders

Dollar amounts on tech debt ("$560K to fix everything"). Grade trends over time with ETA-to-Grade-A predictions. Knowledge-silo risk flags single-contributor files. Breaking-change detection with caller blast-radius. AI-era risk detection catches hallucinated dependencies, secret-to-LLM leaks, and insecure defaults. Budget conversations backed by per-finding estimates — not vibes.

📋 For Compliance & IT

Eight compliance frameworks on every PR: SOC 2 (8 controls), HIPAA Technical Safeguards, PCI DSS 4.0, NIST 800-53 Rev 5, ISO 27001:2022, plus three opt-in AI-era frameworks (EU AI Act, ISO/IEC 42001, NIST AI RMF) as evidence supporting those obligations — not a certification. PASS / CONCERN / FAIL per control with AICPA / NIST citation text — continuous Type II-ready evidence. Per-PR posture delta: "CC3.2 CONCERN→PASS ✅". Risk register with 7-day-critical / 30-day-major SLA fields. MSA-ready enterprise contracts with reverse-engineering prohibition + DPA.

What a clean scan looks like

Below is the actual Step Summary PullGuard renders in GitHub Actions on every PR. This is a Team-tier scan showing all 46 analyzers running on a well-maintained codebase. The same layout appears for any repo — green when you're clean, with drill-down details when you're not.

🟢 PullGuard Report

Score: 96/100 · Grade 🟢 A · 0 findings across 247 files · 46/46 analyzers · Team tier

Duration: ~8s (cached rescans <100ms) · License: valid · Trend: improving (85 → 96 over last 5 scans)

📊 Health Dashboard

Category	Grade	Change
Security (15 OWASP checks)	A	—
Supply Chain (Actions + Dockerfile + git history)	A	—
Dependencies (5 CVE ecosystems)	A	—
Code Quality	A	—
Architecture	A	—
Testing	A	—
Compliance (SOC 2)	A	—
AI Code Detection	A	—
Git History	A	—
Type Coverage	A	—

🏆 Top Risks

No critical or major findings. Your codebase is clean.

💰 Cost-of-Change

Severity	Count	Est. Fix Cost
Critical	0	$0
Major	0	$0
Moderate	0	$0
Total	0	$0

📋 SOC 2 Security Evidence (8 controls)

Control	Status	Evidence
CC3.1 (Risk Assessment)	✅ PASS	No unmitigated security findings
CC3.2 (Fraud Risk)	✅ PASS	No hardcoded credentials or historical secrets
CC4.1 (Continuous Monitoring)	✅ PASS	Per-PR scans + trend tracking provide ongoing evidence
CC6.1 (Logical Access)	✅ PASS	No authentication or authorization weaknesses
CC6.2 (Authentication)	✅ PASS	No weak / missing auth on identified endpoints
CC6.7 (Cryptographic Controls)	✅ PASS	No insecure crypto, weak RNG, or timing-attack vectors
CC6.8 (Unauthorized Software Prevention)	✅ PASS	All dependencies current, no unpinned GHA, no risky Dockerfile patterns
CC8.2 (Change Impact Analysis)	✅ PASS	Breaking-change detection + caller blast radius surfaced

Compliance posture delta: CC3.2 CONCERN→PASS ✅ · CC6.8 CONCERN→PASS ✅ (2 controls improved since last scan) · Plus HIPAA / PCI DSS 4.0 / NIST 800-53 / ISO 27001:2022 sections opt-in via compliance: in .driftrc.yml

📈 Trend

Improving · Score 85 → 96 over last 5 scans · ETA to Grade A: achieved

Generated by @pullguard/cli in ~8s · 46 analyzers · Team tier

This is the same Step Summary you'll see in your GitHub Actions tab on every PR. Enterprise evaluators: this output renders identically for you during your security-review period — the report shape is a contract, not a teaser.

Simple pricing

Self-serve for small teams. Enterprise conversations for larger orgs.

Free

forever

✓ 14 core analyzers (incl. dangerous-files & repo-hygiene)
✓ Unlimited public repos
✓ 1 private repo
✓ Grade, score, findings
✗ Security & taint analysis
✗ Cost estimation
✗ SOC 2 compliance

Get Started Free

Pro

$29/mo

per month

✓ 44 of 46 analyzers
✓ 1 private repo
✓ Security & taint analysis
✓ AI-era risk detection
✓ Cost-of-change estimation
✓ SARIF for Code Scanning
✓ Dependency CVE database

Subscribe to Pro

Solo developers & single projects.

Team

$99/mo

per month

✓ Everything in Pro
✓ Up to 10 private repos
✓ Unlimited contributors
✓ All 46 analyzers
✓ Custom rules (YAML policies)
✓ Custom taint sources & sinks
✓ Local SOC 2 / HIPAA compliance evidence reports
✗ Centralized dashboard or persistent triage database

Subscribe to Team

Startups & mid-sized engineering teams.

Enterprise

From $15k/yr

annual contract

Repository bands

Starter — up to 50 repos$15k/yr

Growth — up to 200 repos$30k/yr

Unlimited repos$60k/yr

✓ Everything in Team
✓ Self-hosted PullGuard Server — org-wide dashboards, source never leaves your runners; a read-only query API to embed results in your own control-plane UI
✓ Finding triage with an immutable audit trail — disposition findings per line (acknowledge / false-positive / won't-fix); every decision is hash-chained and admin-exportable for auditors
✓ SSO: SAML 2.0 & OIDC (Okta, Azure AD, Google, OneLogin)
✓ RBAC (Viewer / Maintainer / Admin)
✓ Persistent triage database — dismiss a false positive once, across all future scans
✓ Air-gapped deployment (no call-home)
✓ Priority 4 business-hour response SLA + dedicated Slack channel
○ Tamper-proof audit logs & export — on the roadmap

Custom contract availablei DPA, MSA with reverse-engineering prohibition + audit rights, customer-managed deployment, bespoke rule sets, dedicated CSM, quarterly vendor-risk review.

Book a 30-min call

50+ repos, regulated industries, org-wide security.

Need more than Team's 10 repos? Enterprise scales by repository band (50 / 200 / unlimited) with a self-hosted server, SSO, dedicated support, and a signed contract. Ask about competitor migration (Semgrep / SonarQube / Snyk) with preserved rulesets.

Get started in 60 seconds

No account, no email, no credit card. Add one file to your repo.

# .github/workflows/pullguard.yml

name: PullGuard
on: [pull_request]
permissions:
  contents: read
  pull-requests: write
jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: pullguard-dev/pullguard-action@v1
        # Free: 14 analyzers. Add license-key for Pro (44 of 46) or Team/Enterprise (all 46 + custom rules + 8 compliance frameworks)

Copy the YAML

Add the workflow file above to your repo. That's the entire setup.

Open a PR

PullGuard scans automatically. Grade, findings, and cost estimate appear in Actions.

Upgrade when ready

Add a license key secret to unlock all 46 analyzers, taint tracking, supply-chain + IaC checks, and SOC 2 evidence.

Read the install guide View on GitHub Marketplace

Free tier — no account required. Pro/Team/Enterprise: hello@pullguard.dev

Frequently asked questions

Security, pricing, languages, AI-code coverage, and compliance — answered.

What is PullGuard?

PullGuard is a SAST (static application security testing) scanner that reviews every GitHub pull request for security, code quality, and compliance issues. It runs as a GitHub Action or Docker container inside your own CI, posts findings as a PR comment and Check Run, and grades the change so problems are caught before they merge.

How is PullGuard different from SonarQube, Snyk, or Semgrep?

PullGuard combines what usually takes several tools: OWASP coverage including the LLM and Agentic Top-10, exploit-aware CVE scanning (EPSS plus CISA KEV), cross-file taint tracking across 7 languages, supply-chain and IaC checks, and compliance evidence — all in one GitHub-native tool. Your code never leaves your CI runner.

Is there a free tier?

Yes. The Free tier is $0, includes 14 analyzers, covers unlimited public repositories plus one private repository, and requires no account. Paid tiers (Pro, Team, Enterprise) unlock the full analyzer set, taint tracking, and all compliance frameworks.

Which languages does PullGuard support?

PullGuard recognises 67 languages, with deep AST-based taint tracking across 7 of them, including JavaScript and TypeScript, Python, Java, Go, C#, and Rust.

Can PullGuard secure code written by AI assistants like Copilot?

Yes, that is a core focus. PullGuard checks the OWASP LLM and Agentic Top-10, flags insecure-by-default and hallucinated-dependency patterns common in AI-generated code, and composes an AI×security risk signal so AI-authored changes get extra scrutiny.

Does PullGuard help with the EU AI Act and NIST AI RMF?

PullGuard can produce AI-authorship provenance markers and security evidence that support your documentation toward frameworks such as the EU AI Act (Article 50) and the NIST AI Risk Management Framework. This is advisory evidence to assist your own compliance process — PullGuard is not a certification and does not by itself make code compliant.

Which compliance frameworks does PullGuard cover?

PullGuard maps findings to eight frameworks: the five classic ones — SOC 2, HIPAA, PCI DSS 4.0, NIST 800-53, and ISO 27001 — plus three opt-in AI-era frameworks — EU AI Act, ISO/IEC 42001, and NIST AI RMF — and surfaces a compliance posture on every pull request. The three AI-era frameworks produce advisory evidence supporting those obligations; they are not a certification and do not by themselves make code compliant.

Does my source code leave my infrastructure?

No. PullGuard runs entirely on your own GitHub Actions runners. Source code, file contents, and analysis results stay in your CI — paid tiers send only a license key and repository name for subscription validation.

Secure the code your AI writes — on every pull request

Code stays on your runners

8 compliance frameworks

High signal, not noise

Procurement-ready

Attacks aimed at your AI coding assistants — caught in review

Six categories of risk, one scan

Security (15 OWASP Checks)

Compliance Evidence (8 Frameworks)

Endpoint Risk Engine

Code Quality

Supply Chain & IaC

Secure & Govern AI-Written Code

Cost-of-Change Estimation

One tool replaces three

Built for the enterprise buying center

🛡️ For Security Leaders

📊 For Engineering Leaders

📋 For Compliance & IT

What a clean scan looks like

📊 Health Dashboard

🏆 Top Risks

💰 Cost-of-Change

📋 SOC 2 Security Evidence (8 controls)

📈 Trend

Simple pricing

Free

Pro

Team

Enterprise

Get started in 60 seconds

Copy the YAML

Open a PR

Upgrade when ready

Frequently asked questions

Secure the code
your AI writes — on every pull request