Code Guard AI

Code Guard AI is a beginner-friendly static security scanner for Python source code. It uses Python's AST and regular expressions to identify common vulnerabilities and hardcoded secrets, calculate a risk score, and produce actionable reports. Scanned code is read and inspected; it is never executed or imported.

Features

• Detects common Python vulnerabilities (CG001–CG008).
• Detects hardcoded secrets and credential patterns (SEC001–SEC006).
• Calculates a severity-based risk score and risk level.
• Generates sanitized Markdown and JSON reports.
• Scans individual Python files or directories from the command line.
• Provides a Streamlit interface for pasted code and uploaded .py files.
• Does not persist scanned source or reports unless a user downloads a report.

Detection rules

ID	Severity	Description
CG001	High	Detects eval() and exec() calls that can execute untrusted code.
CG002	High	Detects subprocess calls with shell=True and os.system() calls.
CG003	High	Detects dynamically constructed SQL passed to .execute().
CG004	High	Detects pickle deserialization and yaml.load() without SafeLoader.
CG005	Medium	Detects weak MD5 and SHA-1 hash functions.
CG006	Medium	Detects requests calls that disable TLS verification.
CG007	Medium	Detects run(debug=True) calls.
CG008	Low	Detects assertions used for validation outside tests and bare except clauses.
SEC001	High	Detects non-empty string literals assigned to password-like names.
SEC002	High	Detects long string literals assigned to API-key or token-like names.
SEC003	High	Detects AWS, GitHub, Slack, and sk- token formats.
SEC004	High	Detects PEM private key block headers.
SEC005	Medium	Detects database connection strings containing credentials.
SEC006	Low	Detects high-entropy strings assigned to secret-like names.

Secret values are masked in findings and reports.

Installation (Windows)

From PowerShell, open the project folder and create the virtual environment:

py -m venv .venv
.\.venv\Scripts\Activate.ps1
python -m pip install -r requirements.txt

If PowerShell prevents environment activation, invoke the environment's Python directly, for example:

.\.venv\Scripts\python.exe -m pip install -r requirements.txt

Run the Streamlit app

streamlit run app.py

The app has a Paste Code tab and an Upload Files tab. Uploads must be Python files no larger than 1 MB each. It does not save scanned code.

Command-line scanner

Scan a Python file or directory:

python -m codeguard <path>

Choose Markdown or JSON output and optionally save the report:

python -m codeguard <path> --format json
python -m codeguard <path> --format markdown --output report.md

Options:

• --format markdown|json: choose the report format (Markdown is the default).
• --output report_file: save the report instead of printing it.

The CLI exits with code 1 if any High severity finding is present, and code 0 otherwise. A missing or unsupported path produces a friendly error.

Run tests

python -m pytest

Project structure

.
├── .github/
│   └── copilot-instructions.md
├── codeguard/
│   ├── rules/
│   │   ├── __init__.py
│   │   ├── secrets.py
│   │   └── vulnerabilities.py
│   ├── __init__.py
│   ├── __main__.py
│   ├── app_helpers.py
│   ├── cli.py
│   ├── models.py
│   ├── report.py
│   ├── scanner.py
│   └── scoring.py
├── samples/
│   └── vulnerable_example.py
├── tests/
│   ├── test_app_helpers.py
│   ├── test_cli.py
│   ├── test_report.py
│   ├── test_scanner.py
│   ├── test_scoring.py
│   ├── test_secret_rules.py
│   └── test_vulnerability_rules.py
├── app.py
├── pytest.ini
└── requirements.txt

Limitations

• Static analysis can miss problems and can produce false positives.
• The scanner covers Python source code only.
• It does not check third-party dependencies for known vulnerabilities.
• A clean report does not guarantee that code is secure.

Future improvements

• Add dependency vulnerability checks.
• Add an ML or LLM explanation layer.
• Support more programming languages.
• Add a GitHub Action for automated repository scans.

Intentionally insecure sample

samples/vulnerable_example.py is deliberately insecure for scanner testing and contains only fake values. Never use it in a real project.