Cross-file dataflow analysis. Type-aware. Open source SAST that cuts through the noise and finds real vulnerabilities.
brew install shivasurya/tap/pathfindermacOS & Linux • v2.1.0
Supported languages
Get findings you feel confident bringing to developers across SAST, SCA, and Secrets scanning. Filter out the false positives that traditional tools always flag with contextual, AI-powered noise filtering.
Read our guide on reducing false positivesAutomatically hide likely false positives from developers. Present findings and fixes to developers in their native workflows with structural search, call graphs, and source-to-sink tracing.
Explore security rules and code graph analysisSee findings in your editor, pull requests, and CI pipelines with a single configuration. Export SARIF and DefectDojo reports with severity mapping for smooth triage and tracking.
Lightning-fast scans with AI precision that actually catches vulnerabilities.
Protect your code with an ever-growing set of security rules covering OWASP Top 10, CVEs, and framework-specific vulnerabilities.
Dockerfile uses sudo in RUN instructions. This is unnecessary during build (already root) and increases security risk if sudo remains in the final image. Use USER instruction for privilege changes instead.
Service does not have no-new-privileges security option. Without this, processes inside the container can gain additional privileges via setuid binaries or capability escalation.
Detects use of the IDEA cipher through the cryptography library, which has a 64-bit block size making it vulnerable to Sweet32 birthday attacks and is deprecated in modern cryptographic standards.
User-controlled input flows into go-resty HTTP client calls without URL validation, enabling SSRF attacks that steal cloud metadata credentials or probe internal services.
yum install without -y flag. Add -y for non-interactive builds.
Service has label:disable in security_opt, which disables SELinux mandatory access control. This removes an important defense-in-depth layer for container isolation.
Query your codebase with natural language through Claude Code, Codex, OpenCode, or Windsurf. Get instant answers about function calls, dependencies, and code structure without leaving your editor.
Focus on real vulnerabilities with AI-powered precision that cuts through the noise of traditional security scanners.