graudit

No entries match these filters. Clear filters

1. v4.1 Oct 13, 2026 · issue 106

   Adds a rule linter script for validating graudit signature databases.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v4.1 https://github.com/wireghoul/graudit.git
   # already have the repo? check out this version:
   $ git checkout v4.1

   • New detection Regex DoS (ReDoS) rules
   • New detection Secrets detection rules
   • New supported platform iOS rules
   • New supported platform Ruby rules
   • New detection Default rules
   • Updated detection Extended regex correctness updates across multiple rule databases
2. docs update Sep 8, 2026 · issue 068

   graudit 3.9 adds JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. and Docker signature databases, plus Git and SVNSVNApache Subversion, an open-source centralized version control system maintained by the Apache Software Foundation, used by tools to track, branch, and merge source code changes across a shared repository. history-scanning misc scripts.

   └──▷ TRY IT
   Scan every commit in a feature branch for leaked secrets before merging to main.
   copy

   $ misc/giterate.sh secrets feature-branch

   Audit all past SVN revisions in the current working path for secrets using graudit rules.
   copy

   $ misc/svnumerate.sh secrets .

   Check a Dockerfile for dangerous patterns such as running as root or mounting the Docker socket.
   copy

   $ graudit -d docker Dockerfile

   • Adds signatures/jwt.db signature database for scanning JWT-related patterns across all supported language rulesets.
   • Adds signatures/docker.db signature database with rules flagging RUN sudo, USER root, and VOLUME /var/run/docker.sock in Dockerfiles.
   • Adds misc/giterate.sh script to iterate through every Git commit and run graudit rules against each commit diff, with optional branch scoping.
   • Adds misc/svnumerate.sh script to iterate through every SVN revision and run graudit rules against each revision diff.
   • Adds misc/svnscan script to check out and scan an SVN repository URL directly.

   +1 more show less

   • Adds misc/svnlog.sh script to search SVN revision history log messages for security-relevant keywords.

   6 details in Everything

3. docs update Jul 24, 2026 · issue 024

   graudit gains JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. rules, SVNSVNApache Subversion, an open-source centralized version control system maintained by the Apache Software Foundation, used by tools to track, branch, and merge source code changes across a shared repository. repo scanning, commit-log vuln checks, and expanded rulesets across 8+ languages

   • Adds JWT detection ruleset for identifying JWT-related vulnerabilities in source code.
   • Enables scanning of SVN repositories by checking out and running rules against them.
   • Supports running rules on every commit in a git repository's history.
   • Adds ability to check for vulnerabilities in commit log messages.
   • Adds detection of SQLiSQLiAn attack that makes an application treat untrusted input as part of a database command. It can expose or modify data by changing what the query does. override suppression patterns in .NET code.

   +2 more show less

   • Expands rulesets for Go, SQL, secrets, .NET, Java, JavaScript, Python, PHP, Ruby, and Scala.
   • Updates Docker rules and test cases with new detection patterns.

   7 details in Everything

4. docs update Jul 24, 2026 · docs issue 004

   graudit gains JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. rules, SVNSVNApache Subversion, an open-source centralized version control system maintained by the Apache Software Foundation, used by tools to track, branch, and merge source code changes across a shared repository. repo scanning, commit-log vuln checks, and expanded rulesets across 8+ languages

   • Adds JWT detection ruleset for identifying JWT-related vulnerabilities in source code.
   • Enables scanning of SVN repositories by checking out and running rules against them.
   • Supports running rules on every commit in a git repository's history.
   • Adds ability to check for vulnerabilities in commit log messages.
   • Adds detection of SQLiSQLiAn attack that makes an application treat untrusted input as part of a database command. It can expose or modify data by changing what the query does. override suppression patterns in .NET code.

   +2 more show less

   • Expands rulesets for Go, SQL, secrets, .NET, Java, JavaScript, Python, PHP, Ruby, and Scala.
   • Updates Docker rules and test cases with new detection patterns.

   7 details in Everything

5. docs update Jul 24, 2026 · issue 024

   graudit 3.9 adds JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. and Docker rule sets plus four new misc helper scripts for git, SVNSVNApache Subversion, an open-source centralized version control system maintained by the Apache Software Foundation, used by tools to track, branch, and merge source code changes across a shared repository., and serial enumeration.

   • Adds giterate misc script for iterating over git repositories.
   • Adds snumerate misc script for serial/sequential enumeration tasks.
   • Adds svnlog misc script for working with SVN log output.
   • Adds svnscan misc script for scanning SVN repositories.
   • Adds new JWT detection rules.

   +1 more show less

   • Adds new Docker-related detection rules.

   6 details in Everything

6. docs update Jul 24, 2026 · docs issue 004

   graudit 3.9 adds JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. and Docker rule sets plus four new misc helper scripts for git, SVNSVNApache Subversion, an open-source centralized version control system maintained by the Apache Software Foundation, used by tools to track, branch, and merge source code changes across a shared repository., and serial enumeration.

   • Adds giterate misc script for iterating over git repositories.
   • Adds snumerate misc script for serial/sequential enumeration tasks.
   • Adds svnlog misc script for working with SVN log output.
   • Adds svnscan misc script for scanning SVN repositories.
   • Adds new JWT detection rules.

   +1 more show less

   • Adds new Docker-related detection rules.

   6 details in Everything

7. docs update Jul 24, 2026 · issue 024

   graudit 4.0 adds seventaint.sh PHP taint-flow tracker, 3rd-party JS ruleset, and expanded exec/suppression signatures.

   └──▷ TRY IT
   Trace user-controlled input through up to 7 hops of PHP variable assignment to reach dangerous sinks like exec() or mysqli_query().
   copy

   $ bash misc/seventaint.sh /path/to/php/project

   Audit a JavaScript codebase for suspicious third-party script inclusion and eval patterns using the new 3partyjs ruleset.
   copy

   $ graudit -d misc/3partyjs.db /path/to/js/project

   • Adds seventaint.sh misc script that performs iterative (up to 7-hop) PHP taint-flow analysis from user-supplied sources ($_GET, $_POST, etc.) to dangerous sinks (exec, eval, mysqli_query, etc.).
   • Adds 3partyjs.db signature database for detecting third-party JavaScript inclusion patterns (dynamic script/iframe creation, external URL references, eval with concatenation, keyboard event listeners).
   • Expands exec.db with cross-language OS-command-execution patterns covering Python (subprocess, Popen, getoutput, execfile), Ruby (instance_eval, module_eval, class_eval, trycmd), and generic fork, openpty, Pipe, and spawn calls.
   • Extends suppression rules to recognise @codingStandardsIgnore and # nosec markers, reducing noise from intentionally audited code.
   • Broadens .NET SQL injectionSQL injectionAn attack that makes an application treat untrusted input as part of a database command. It can expose or modify data by changing what the query does. signatures to match named/string format-string placeholders ({A-Za-z0-9}) in addition to numeric ones, catching more interpolated query patterns.

   5 details in Everything

8. docs update Jul 24, 2026 · docs issue 004

   graudit 4.0 adds seventaint.sh PHP taint-flow tracker, 3rd-party JS ruleset, and expanded exec/suppression signatures.

   └──▷ TRY IT
   Trace user-controlled input through up to 7 hops of PHP variable assignment to reach dangerous sinks like exec() or mysqli_query().
   copy

   $ bash misc/seventaint.sh /path/to/php/project

   Audit a JavaScript codebase for suspicious third-party script inclusion and eval patterns using the new 3partyjs ruleset.
   copy

   $ graudit -d misc/3partyjs.db /path/to/js/project

   • Adds seventaint.sh misc script that performs iterative (up to 7-hop) PHP taint-flow analysis from user-supplied sources ($_GET, $_POST, etc.) to dangerous sinks (exec, eval, mysqli_query, etc.).
   • Adds 3partyjs.db signature database for detecting third-party JavaScript inclusion patterns (dynamic script/iframe creation, external URL references, eval with concatenation, keyboard event listeners).
   • Expands exec.db with cross-language OS-command-execution patterns covering Python (subprocess, Popen, getoutput, execfile), Ruby (instance_eval, module_eval, class_eval, trycmd), and generic fork, openpty, Pipe, and spawn calls.
   • Extends suppression rules to recognise @codingStandardsIgnore and # nosec markers, reducing noise from intentionally audited code.
   • Broadens .NET SQL injectionSQL injectionAn attack that makes an application treat untrusted input as part of a database command. It can expose or modify data by changing what the query does. signatures to match named/string format-string placeholders ({A-Za-z0-9}) in addition to numeric ones, catching more interpolated query patterns.

   5 details in Everything

9. docs update Jul 24, 2026 · issue 024

   graudit gains new detection rules for AMPscript injection, 3rd-party JS dynamic eval, seventaint.sh script, and expanded coverage across Python, Ruby, PHP, and more

   • Adds AMPscript injection detection rules.
   • Adds rules for detecting dynamic evaluation of 3rd-party JavaScript scripts.
   • Adds seventaint.sh helper script to the misc collection.
   • Adds Ruby rules covering SQL injectionSQL injectionAn attack that makes an application treat untrusted input as part of a database command. It can expose or modify data by changing what the query does., XSSXSSCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session., exec, open redirect, IDORIDORInsecure Direct Object Reference, a web vulnerability where an application exposes internal identifiers (IDs, filenames) without access checks, letting an attacker substitute another user's ID to reach their data., mass assignment, info leak, certificate verification, and auth checks.
   • Expands Python rules with coverage for exec, SSH, Flask, Django, YAML, pickle, file handling, and SQLiSQLiAn attack that makes an application treat untrusted input as part of a database command. It can expose or modify data by changing what the query does. patterns.

   +4 more show less

   • Adds PHP suppression support for PHP Code Sniffer and new SQLi rules.
   • Adds .NET and Ruby SQL injection detection updates.
   • Adds Bandit suppression support.
   • Improves secrets detection in XML and adds auth/GitHub-specific secret rules.

   9 details in Everything

10. docs update Jul 24, 2026 · docs issue 004

    graudit gains new detection rules for AMPscript injection, 3rd-party JS dynamic eval, seventaint.sh script, and expanded coverage across Python, Ruby, PHP, and more

    • Adds AMPscript injection detection rules.
    • Adds rules for detecting dynamic evaluation of 3rd-party JavaScript scripts.
    • Adds seventaint.sh helper script to the misc collection.
    • Adds Ruby rules covering SQL injectionSQL injectionAn attack that makes an application treat untrusted input as part of a database command. It can expose or modify data by changing what the query does., XSSXSSCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session., exec, open redirect, IDORIDORInsecure Direct Object Reference, a web vulnerability where an application exposes internal identifiers (IDs, filenames) without access checks, letting an attacker substitute another user's ID to reach their data., mass assignment, info leak, certificate verification, and auth checks.
    • Expands Python rules with coverage for exec, SSH, Flask, Django, YAML, pickle, file handling, and SQLiSQLiAn attack that makes an application treat untrusted input as part of a database command. It can expose or modify data by changing what the query does. patterns.

    +4 more show less

    • Adds PHP suppression support for PHP Code Sniffer and new SQLi rules.
    • Adds .NET and Ruby SQL injection detection updates.
    • Adds Bandit suppression support.
    • Improves secrets detection in XML and adds auth/GitHub-specific secret rules.

    9 details in Everything

11. v4.0 Dec 19, 2025 · release notes

    graudit v4.0 adds seventaint.sh script and new 3partyjs third-party JavaScript ruleset

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v4.0 https://github.com/wireghoul/graudit.git
    # already have the repo? check out this version:
    $ git checkout v4.0

    • New seventaint.sh script added to the misc collection for taint-analysis workflows.
    • New 3partyjs ruleset in misc enables scanning for vulnerabilities in third-party JavaScript.

    2 details in Everything

12. v3.9 May 22, 2025 · release notes

    graudit v3.9 adds JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. and Docker detection rules plus four new repo-scanning helper scripts

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.9 https://github.com/wireghoul/graudit.git
    # already have the repo? check out this version:
    $ git checkout v3.9

    • New jwt ruleset for detecting JWT-related security issues in source code.
    • New Docker ruleset for flagging security issues in Dockerfiles and container configs.
    • New giterate misc script for iterating over git repositories.
    • New snumerate misc script added to the misc tooling collection.
    • New svnlog misc script for working with Subversion logs.

    +2 more show less

    • New svnscan misc script for scanning Subversion repositories.
    • Updated rulesets for dotnet, Go, Java, JavaScript, PHP, Python, Ruby, Scala, SQL, and secrets detection.

    7 details in Everything

13. v3.6 Apr 9, 2024 · release notes

    graudit v3.6 adds support for scanning Kotlin codebases and updates rule sets.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.6 https://github.com/wireghoul/graudit.git
    # already have the repo? check out this version:
    $ git checkout v3.6

    • Updated JavaScript, PHP, Python, Golang, C, Android, Dotnet, Nim, Suppression, XSSXSSCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session., SQLiSQLiAn attack that makes an application treat untrusted input as part of a database command. It can expose or modify data by changing what the query does., Exec, Default, and Fruit rule sets for improved detection

    1 detail in Everything

14. v3.5 Dec 23, 2022 · release notes

    graudit v3.5 adds Eiffel, TypeScript, and updated secret detection rules

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.5 https://github.com/wireghoul/graudit.git
    # already have the repo? check out this version:
    $ git checkout v3.5

    • Adds Eiffel language support for secret scanningsecret scanningChecking files, code or other data for exposed credentials such as passwords, API keys and tokens. Findings help teams remove the secret and revoke or rotate it. via new eiffel rules
    • Adds TypeScript language support for secret scanning via new typescript rules
    • Updates core secret detection rules with reduced false positives for PHP and Nim

    3 details in Everything

15. v3.4 Mar 1, 2022 · release notes

    graudit v3.4 adds support for setting default arguments via environment variables

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.4 https://github.com/wireghoul/graudit.git
    # already have the repo? check out this version:
    $ git checkout v3.4

16. 3.3 Jan 20, 2022 · release notes

    graudit 3.3 introduces SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. exclusion auditing rules and expanded rule sets for multiple languages

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.3 https://github.com/wireghoul/graudit.git
    # already have the repo? check out this version:
    $ git checkout 3.3

    • Rule set for auditing SCA exclusions adds a new detection capability to audit Software Composition Analysis (SCA) tool exclusions.

    1 detail in Everything

17. 3.1 Jun 21, 2021 · release notes

    graudit v3.1 adds ~/graudit/signatures to its default database lookup paths

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.1 https://github.com/wireghoul/graudit.git
    # already have the repo? check out this version:
    $ git checkout 3.1

    └──▷ TRY IT
    Place custom secret detection rules in the new default path so graudit finds them without needing a manual --rules flag.
    copy

    $ mkdir -p ~/graudit/signatures && cp my_custom_rules.yaml ~/graudit/signatures/

    • ~/graudit/signatures is now included in the tool's standard database locations for rule discovery

    1 detail in Everything

18. 2.6 Jun 19, 2020 · release notes

    graudit 2.6 adds Scala rule support and overhauls .NET and Java detection rules.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.6 https://github.com/wireghoul/graudit.git
    # already have the repo? check out this version:
    $ git checkout 2.6

    • Added basic scala rules to expand language coverage for source code analysis
    • Overhauled dotnet rules to improve detection capabilities for .NET applications
    • Updated Java rules for enhanced coverage of Java-specific patterns

    3 details in Everything

19. v2.4 Mar 28, 2020 · release notes

    Adds low-hanging fruit databases for several languages, Go language support, and COBOL support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.4 https://github.com/wireghoul/graudit.git
    # already have the repo? check out this version:
    $ git checkout v2.4

    • Added basic support for Go language
    • Added basic support for COBOL

    2 details in Everything

20. v2.3 Oct 15, 2019 · release notes

    New C/C++ database with low-hanging fruit rules, new flatline scripts for PHP taint analysis and GitHub scanning, and a grauf...

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.3 https://github.com/wireghoul/graudit.git
    # already have the repo? check out this version:
    $ git checkout v2.3

    └──▷ TRY IT
    Scan a local project directory for high-impact PHP security bugs using the new flatline script.
    copy

    $ ./misc/flatline.php /path/to/website

    Scan a remote GitHub repository for secrets and interesting files using the new graufflehog script.
    copy

    $ ./misc/graufflehog.sh https://github.com/user/repo

    Perform taint analysis on C code using the new b0ftaint script.
    copy

    $ ./misc/b0ftaint.sh /path/to/source.c

    • Adds seafruit.db, a new C/C++ detection database containing low hanging fruit rules for finding common security issues.
    • Adds misc/flatline.* script to find high-impact PHP bugs using flatline pattern rules.
    • Adds misc/vulntaint.sh script to apply flatline rules within taint analysis workflows.
    • Adds misc/gitscan script for scanning GitHub repositories using the flatline rule engine.
    • Adds misc/graufflehog.sh script to search codebases for interesting files and secrets.

    +1 more show less

    • Adds misc/b0ftaint.sh script to display C taint analysis results.

    6 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The all rules database has been removed, so references to it in existing workflows will no longer work.