FoxGuard

What it is

FoxGuard (0sec-labs/foxguard, GitHub Action pinned at v0.14.0) — the scanner is described in the catalog summary. What follows is the operational detail the summary omits: how to install and verify it, how --fix behaves, and how to run the hosted GitHub App safely.

Install and verify

Four install paths, in increasing commitment: npx foxguard . (zero install), pipx install foxguard (PyPI CLI), the curl … install.sh | sh binary, or cargo install foxguard from source. PyPI wheels need Python 3.9+ on Linux glibc 2.28+, macOS, or Windows x86_64, and install a native CLI — no Python API is provided; Alpine/musl users must use the standalone Linux binaries. Release binaries carry checksums and GitHub artifact attestations:

gh attestation verify

Autofix behavior

foxguard --fix src/ or foxguard --fix src/app.py applies supported taint fixes in place. Fixes are scoped: targets are checked against the canonical scan directory or selected file, and findings outside that scope are skipped. Python command-injection fixes add import subprocess when needed while preserving module docstrings and future imports. Review generated changes before committing.

Exit codes matter for CI

File-read, metadata, and directory-traversal failures in the native scanner exit 2 rather than emitting a successful report or overwriting a baseline — so a non-zero exit here is a scan failure, not a findings hit. Intentional exclusions and unsupported/binary/oversized files remain skips; check the skipped-file notices to confirm coverage.

Running the GitHub App

Operational constraints the summary can't carry:

• Persist FOXGUARD_INSTALLATIONS_PATH and FOXGUARD_PULL_REQUEST_JOBS_PATH on durable storage — the installation registry reconciles against GitHub's API at startup and hourly, and failed refreshes only retain existing state.
• Size FOXGUARD_PR_WORKERS against measured scanner peak memory versus the container limit: child-process OOM kills can occur without restarting the hosted app, so undersizing silently drops work.
• Monitor foxguard.installations.reconcile_failed alongside scan failures; foxguard.installations.reconciled reports internal/external/unknown counts.
• Set FOXGUARD_INTERNAL_ACCOUNTS (case-insensitive, comma-separated) to classify your own orgs; unset or missing owner yields unknown.

Caveats

The page cautions that its own telemetry is weak evidence: "External activity is not proof of a paying customer, and scans are not people," and observed repository names "are not a complete inventory of an installation's accessible repositories." Treat the registry as best-effort, not authoritative.