GitHub - Corgea/Sighthound: Corgea's rule-based SAST scanner

Want Sighthound without the setup? Sign up for Corgea, where Sighthound is built in alongside AI SAST, secrets, container, dependency, and IaC scanning—with false-positive reduction and automated fixes.

What It Does

• Scans source code for security issues using AST-aware rules.
• Supports pattern mode and taint mode (source to sink tracking).
• Handles multi-file projects and parallel execution.
• Outputs findings as text, JSON, CSV, or SARIF.
• Loads embedded rule packs by file extension, with optional file-based custom rules.

Language Support

Not currently supported: Razor (.cshtml), C/C++ (.c, .h).

SQL limitations. SQL is matched textually, not parsed. Sighthound compiles no SQL grammar and performs no dataflow or taint analysis on SQL, so rules match against the whole file rather than against parsed statements.

• Patterns without a wildcard match as substrings anywhere in the file.
• Patterns containing * are globs evaluated against the whole file, so they are anchored at the first byte: EXEC(@sql); on line 1 is reported, the same statement on line 2 is not.
• Findings report the matched line as both their start and end line.
• The bundled rules are tautology- and payload-oriented. Dynamic SQL inside a stored-procedure body, CREATE USER … IDENTIFIED BY '…', and GRANT ALL … TO PUBLIC are not detected.
• Dialect-specific syntax (T-SQL, PL/SQL, PL/pgSQL) is not understood.
• .ddl and .dml files are recognized and scanned, but every bundled rule is scoped to .sql, so the bundled pack reports nothing for them. Use --rules-dir with rules whose file_types include those extensions.
• The bundled SQL pack is pattern-only and ships no mode: "taint" rules. Default combined mode keeps the search findings, while explicit --taint-analysis succeeds with no findings. Text output warns that taint analysis was skipped. The .html and ObjectScript packs behave the same way.
• Files under tests/, test/, vendor/, build/, dist/ and target/ are skipped before language detection (whole-path-component match); --include-test-fixtures reopens tests/ and test/ only.

Expect both false positives (a benign || concatenation is reported, at Low severity) and false negatives (dynamic SQL that is not the first thing in the file is missed).

Installation

Prerequisites:

• Rust 1.85+
• Git

Build from source:

git clone https://github.com/Corgea/Sighthound.git
cd Sighthound
cargo build --release

Binary path: target/release/sighthound

Linux-container-compatible release export:

DOCKER_BUILDKIT=1 docker build \
  --target export \
  --output type=local,dest=./sighthound_release \
  .

Or run ./build_all_platforms.sh.

Agent skill

Using Claude Code, Cursor, Codex, or another coding agent? Install the Sighthound skill so your agent knows how to install the scanner, run it, and act on its findings:

npx skills add corgea/skills --skill sighthound

Quick Start

# Auto-detect languages and run embedded rules
cargo run --bin sighthound -- /path/to/project

# Explicit language + custom rules path
cargo run --bin sighthound -- /path/to/project python rules/python

# Taint-only scan and JSON output
cargo run --bin sighthound -- --taint-analysis --output-format json /path/to/project > findings.json

# SARIF output for GitHub Code Scanning
cargo run --bin sighthound -- --output-format sarif /path/to/project > results.sarif

CLI shape:

sighthound [OPTIONS] <ROOT_DIR> [LANGUAGE] [RULES_PATH]

Run sighthound --help for the full option list.

GitHub Code Scanning

The sarif output format writes SARIF 2.1.0, which GitHub Code Scanning ingests directly. Upload it from a workflow so findings appear inline on the pull request and in the repository's Security tab:

Run the scan from the repository root and use . (or the repository root's absolute path) as <ROOT_DIR> so SARIF artifact URIs stay repository-relative.

- name: Run Sighthound
  run: sighthound --output-format sarif . > results.sarif
- name: Upload SARIF
  uses: github/codeql-action/upload-sarif@v3
  with:
    sarif_file: results.sarif

Rules

Rules are written in RON and support both:

• mode: "search" for pattern matching
• mode: "taint" for source/sink/sanitizer analysis

Start here:

• Rule Writing Guide
• Bundled rules directory

Development

Core commands:

make check        # fix + format + lint + test + suppression report
make pre-commit   # staged Rust files (hook)
make pre-push     # push gate checks
make ci           # strict CI pipeline

Additional quality gates:

make complexity
make audit
make acceptance
cargo harness coverage --min=0
cargo harness crap --max=30

Limitations

• Runtime-only vulnerabilities in dynamic code paths may be missed.
• Very large files can increase scan time.
• Multi-file taint is supported but still an area to harden further.

Contributing

• Contributing Guide
• Code of Conduct
• Security Policy

License

• MIT License
• Third-Party Notices