Skip to main content
Garth’s code security scan identifies vulnerabilities using static analysis, dependency auditing, and secret detection.

​
Static analysis

Garth runs SAST (Static Application Security Testing) rules against your source code to find common vulnerability patterns.
Detects SQL injection, command injection, LDAP injection, and similar patterns where user input reaches sensitive APIs without sanitization.
Flags weak session management, insecure password storage, and missing authentication on sensitive endpoints.
Identifies unencrypted storage of sensitive data, weak cryptographic algorithms, and missing TLS enforcement.
Detects unsafe deserialization of untrusted data that could lead to remote code execution.
Catches overly permissive CORS settings, disabled security headers, and default credentials.

​
Infrastructure-as-Code (IaC)

Garth scans infrastructure definition files for misconfigurations and security policy violations — catching cloud and container issues before they reach production.
Garth analyses the following IaC formats:
  • Terraform — .tf files
  • AWS CloudFormation — template.yaml, template.json
  • Kubernetes — deployment, service, and ingress manifests (.yaml)
  • Dockerfile — Dockerfile and *.dockerfile
  • Docker Compose — docker-compose.yml
Flags infrastructure settings that introduce security risk, such as:
  • Storage buckets or databases with public access enabled
  • Missing encryption at rest or in transit
  • Overly permissive IAM roles or security group rules
  • Root account usage or missing MFA enforcement
  • Containers running as root or with privileged access
Evaluates configurations against common security benchmarks including CIS Foundations, NIST, SOC 2, and PCI DSS controls relevant to cloud infrastructure.

​
Secret detection

Garth scans every file in the repository for leaked credentials and secrets. Detected secrets are reported in the Garth dashboard with the file path, line number, and secret type. Common findings include API keys, tokens, passwords, private keys, and connection strings committed directly to the repository.

​
Dependency scanning

Garth checks your lockfiles against the OSV database and GitHub Advisory Database.
Dependency scanning only runs on files tracked in your repository. Vendored or generated lockfiles must be committed to be scanned.