rnsec is a zero-configuration static analysis security scanner for React Native and Expo applications. It scans JavaScript/TypeScript, XML, plist, and JSON files for over 85 security rules covering storage, network, authentication, cryptography, logging, Android/iOS platform issues, and supply chain risks. The tool uses Babel AST parsing and regex pattern matching to detect hardcoded secrets, insecure configurations, and common vulnerabilities. It generates HTML, JSON, and Markdown reports, supports CI/CD integration with changed-files scanning, and can post results as GitHub PR comments. The architecture is a monolith CLI application built with Commander, with a modular rule engine that registers scanner groups. The codebase is well-structured, TypeScript strict, and includes comprehensive tests for all rules.
Globstar is a static analysis toolkit that enables developers to write custom checkers in YAML or Go and run them via a single portable binary. It uses tree-sitter for AST-based analysis, supporting multiple languages (Go, Java, JavaScript, Python, Ruby, etc.). The tool is designed to be fast, dependency-free, and CI-friendly, with a focus on enforcing learned patterns such as security vulnerabilities and code quality issues. The architecture consists of a CLI layer, an analysis engine for parsing and scope resolution, and a checker system with built-in and custom checker support.
The repository contains only documentation files (README-EN.md and README.md) describing a Java-based SAST tool called 'chanzi'. No source code, binaries, or executable artifacts are present. The documentation outlines the tool's features: taint analysis for vulnerability detection, support for Java frameworks (Spring, Dubbo, etc.), built-in Java runtime, and vulnerability reporting. The repository appears to be maintained with recent commits and issue tracking, but lacks any actual implementation code, rendering it non-functional as a software artifact.