Cross-file dataflow analysis. Type-aware. Open source SAST that cuts through the noise and finds real vulnerabilities.
Choose your preferred installation method
brew install shivasurya/tap/pathfindermacOS & Linux • v2.0.0
Get findings you feel confident bringing to developers across SAST, SCA, and Secrets scanning. Filter out the false positives that traditional tools always flag with contextual, AI-powered noise filtering.
Read our guide on reducing false positivesAutomatically hide likely false positives from developers. Present findings and fixes to developers in their native workflows with structural search, call graphs, and source-to-sink tracing.
Explore security rules and code graph analysisSee findings in your editor, pull requests, and CI pipelines with a single configuration. Export SARIF and DefectDojo reports with severity mapping for smooth triage and tracking.
View GitHub Actions integration →New: PR summary comments & inline security findings →Lightning-fast scans with AI precision that actually catches vulnerabilities.
Protect your code with an ever-growing set of security rules covering OWASP Top 10, CVEs, and framework-specific vulnerabilities.
RUN command uses 'cd' which doesn't persist. Use WORKDIR instead.
Service is running in privileged mode. This grants container equivalent of root capabilities on the host machine. Can lead to container escapes and privilege escalation.
Detects re.compile(), re.match(), re.search(), and re.findall() calls that should be audited for catastrophic backtracking patterns.
WORKDIR should use absolute paths starting with /.
Service mounts Docker socket. The owner of this socket is root. Giving container access to it is equivalent to giving unrestricted root access to host.
Detects use of send_file() and send_from_directory() which serve files from the server's file system and are vulnerable to path traversal when the filename argument comes from user input.
Query your codebase with natural language through Claude Code, Codex, OpenCode, or Windsurf. Get instant answers about function calls, dependencies, and code structure without leaving your editor.
Focus on real vulnerabilities with AI-powered precision that cuts through the noise of traditional security scanners.