Sighthound - Corgea's rule-based SAST scanner

项目说明

Sighthound

<di="center">

!Sighthound Logo

Tree-sitter based static scanner with pattern matching and taint-flow analysis.

![Rust]()
![CI]()

</div>

> Want Sighthound without the setup? Sign up for Corgea,
> where Sighthound is built in alongside AI SAST, secrets, container, dependency,
> and IaC scanning—with false-positi and automated fixes.

What It Does

Scans source code for security issues using AST-aware rules.

Supports pattern mode and taint mode (source to sink tracking).

Handles multi-file projects and parallel execution.

Outputs findings as text, JSON, CSV, or SARIF.

Loads embedded rule packs by file extension, with optional file-based custom rules.

Language Support

| Language | Extensions | Parser | Bundled Rules |
|---|---|---|---|
| Python | .py, .pyw, .pyi, .pyx | Yes | Yes |
| Ja | .js, .mjs, .cjs, .jsx, .vue, .svelte | Yes | Yes |
| TypeScript / TSX | .ts, .tsx, .mts, .cts | Yes | Yes (JS rules) |
| Java | .java | Yes | Yes |
| PHP | .php, .phtml | Yes | Yes |
| C# | .cs, .csx | Yes | Yes |
| Go | .go | Yes | Yes |
| Ruby | .rb | Yes | Yes |
| ObjectScript | .cls, .mac, .inc, .int, .rtn | Yes (class and routine grammars) | Yes |
| HTML | .html, .htm, .twig, .ejs, .hbs, ... | Yes | Yes |
| Django templates | .html (Django syntax) | Yes | Yes (HTML rules) |
| SQL | .sql, .ddl, .dml | No — textual matching | Yes (.sql files only) |

Not currently supported: Razor (.cshtml), C/C++ (.c, .h).

SQL limitations. SQL is matched textually, not parsed. Sighthound compiles no SQL grammar
and performs no dataflow or taint analysis on SQL, so rules match against the whole file
rather than against parsed statements.

Patterns without a wildcard match as substrings anywhere in the file.

Patterns containing * are globs e against the whole file, so they are **anchored

at the first byte**: EXEC(@sql); on line 1 is reported, the same statement on line 2 is not.

Findings report the matched line as both their start and end line.

The bundled rules are tautology- and payload-oriented. Dynamic SQL inside a stored-procedure

body, CREATE USER … IDENTIFIED BY '…', and GRANT ALL … TO PUBLIC are not detected.

Dialect-specific syntax (T-SQL, PL/SQL, PL/pgSQL) is not understood.

.ddl and .dml files are recognized and scanned, but every bundled rule is scoped to

.sql, so the bundled pack reports nothing for them. Use --rules-dir with rules whose
file_types include those extensions.

The bundled SQL pack is pattern-only and ships no mode: "taint" rules. Default combined mode

keeps the search findings, while explicit --taint-analysis succeeds with no findings. Text
output warns that taint analysis was skipped. The .html and ObjectScript packs behave the
same way.

Files under tests/, test/, /, build/, dist/ and target/ are skipped

before language detection (whole-path-component match); --include-test-fixtures reopens
tests/ and test/ only.

Expect both false positives (a benign || concatenation is reported, at Low se) and
false negatives (dynamic SQL that is not the first thing in the file is missed).

Installation

Prerequisites:

Rust 1.88+

Git

Build from source:

Binary path: target/release/sighthound

Linux-container-compatible release export:

Or run ./build_all_platforms.sh.

Agent skill

Using Claude Code, Cursor, Codex, or another coding agent? Install the
Sighthound skill so your agent knows how
to install the scanner, run it, and act on its findings:

Quick Start

CLI shape:

Run sighthound --help for the full option list.

GitHub Code Scanning

The sarif output format writes SARIF 2.1.0, which GitHub Code Scanning
ingests directly. Upload it from a workflow so findings appear inline on the
pull request and in the repository's Security tab:

Run the scan from the repository root and use . (or the repository root's
absolute path) as <ROOT_DIR> so SARIF artifact URIs stay repository-relative.

Rules

Rules are written in RON and support both:

mode: "search" for pattern matching

mode: "taint" for source/sink/sanitizer analysis

Start here:

Rule Writing Guide

Bundled rules directory

De

Core commands:

Additional quality gates:

Limitations

Runtime-only in dynamic code paths may be missed.

Very large files can increase scan time.

Multi-file taint is supported but still an area to harden further.

Contributing

Contributing Guide

Code of Conduct

Security Policy

License

MIT License

Third-Party Notices

项目信息

开发语言：Rust

Star 数：285

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Corgea's rule-based SAST scanner展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。