GitHub - Corgea/Sighthound: Corgea's rule-based SAST scanner

Tree-sitter based static vulnerability scanner with pattern matching and taint-flow analysis.

What It Does

Scans source code for security issues using AST-aware rules. Supports pattern mode and taint mode (source to sink tracking). Handles multi-file projects and parallel execution. Outputs findings as text, JSON, or CSV. Loads embedded rule packs by file extension, with optional file-based custom rules.

Language Support

Language Extensions Parser Bundled Rules

Python .py, .pyw, .pyi, .pyx Yes Yes

JavaScript .js, .mjs, .cjs, .jsx, .vue, .svelte Yes Yes

TypeScript / TSX .ts, .tsx, .mts, .cts Yes Yes (JS rules)

Java .java Yes Yes

PHP .php, .phtml Yes Yes

C# .cs, .csx Yes Yes

Go .go Yes Yes

Ruby .rb Yes Yes

HTML .html, .htm, .twig, .ejs, .hbs, ... Yes Yes

Django templates .html (Django syntax) Yes Yes (HTML rules)

Not currently supported: Razor (.cshtml), C/C++ (.c, .h). Installation Prerequisites:

Rust 1.85+ Git

Build from source: git clone https://github.com/Corgea/Sighthound.git cd Sighthound cargo build --release Binary path: target/release/sighthound Linux-container-compatible release export: DOCKER_BUILDKIT=1 docker build \ --target export \ --output type=local,dest=./sighthound_release \ . Or run ./build_all_platforms.sh.

Quick Start # Auto-detect languages and run embedded rules cargo run --bin sighthound -- /path/to/project

# Explicit language + custom rules path cargo run --bin sighthound -- /path/to/project python rules/python

# Taint-only scan and JSON output cargo run --bin sighthound -- --taint-analysis --output-format json /path/to/project > findings.json CLI shape: sighthound [OPTIONS] <ROOT_DIR> [LANGUAGE] [RULES_PATH] Run sighthound --help for the full option list. Rules Rules are written in RON and support both:

mode: "search" for pattern matching mode: "taint" for source/sink/sanitizer analysis

Start here:

Rule Writing Guide Bundled rules directory

Development Core commands: make check # fix + format + lint + test + suppression report make pre-commit # staged Rust files (hook) make pre-push # push gate checks make ci # strict CI pipeline Additional quality gates: make complexity make audit make acceptance cargo harness coverage --min=0 cargo harness crap --max=30 Limitations

Runtime-only vulnerabilities in dynamic code paths may be missed. Very large files can increase scan time. Multi-file taint is supported but still an area to harden further.

Contributing

Contributing Guide Code of Conduct Security Policy

License

MIT License Third-Party Notices