graudit is a shell script and set of grep-based signature databases that finds potential security flaws in source code, aimed at developers, auditors and security testers who want static analysis while keeping technical requirements to a minimum.

What it is

graudit (short for grep rough audit) is a source code auditing tool written in Shell and released under the GPL-3.0 licence. It runs the GNU grep utility over a codebase using signature sets written as extended regular expressions (POSIX), and it ships with ready-made databases covering many languages and problem classes. It lives in the security and vulnerability-detection ecosystem, tagged security-audit, security-tools and source-code, and it is comparable to static analysis applications such as RATS, SWAAT and flaw-finder.

The problem it solves is the cost of a first pass over unfamiliar or third-party source: instead of installing a heavier analysis application, an auditor runs graudit [opts] /path/to/scan and starts reading matches. It keeps technical requirements to a minimum and stays flexible, but it is a screening aid rather than a verdict, and every hit is a candidate flaw for a human to triage.

Key capabilities

• Bundles databases for actionscript, android, asp, c, cobol, dotnet, eiffel, go, ios, java, js, nim, perl, php, python, ruby, scala, typescript and xss, plus a default database used when -d is omitted.
• Selects a database with -d, taking a named database or a full path to a .db file, and lists them with -l.
• Writes every rule as an extended regular expression (POSIX), so databases can be extended or authored from scratch, and rules can be read from stdin via - or /dev/stdin.
• Resolves databases by a fixed order of precedence, starting with GRDIR and continuing through /usr/share/graudit/, $HOME/.graudit/ and a relative signatures/ directory.
• Tunes output with -c (context lines, default 1), -B (suppress banner), -L (vim-friendly lines), -b (colour-blind friendly template), -z (no colours) and -Z (high contrast).
• Filters scope with -x for comma-separated exclusions such as -x *.js,*.sql, -A to scan unwanted and difficult (ALL) files, and -i for case-insensitive scans.
• Honours GRARGS for default command-line options and reports help and version with -h and -v.

Who uses it and how

• Security auditors and penetration testers run it as a fast first pass over an unfamiliar codebase, then triage the matches by hand.
• Developers clone the repository, add it to PATH in ~/.bashrc and set GRDIR to the signatures directory so it is always available for ad-hoc checks.
• Teams call it from scripts and build steps; the README cautions that GRARGS can affect scripting use and recommends limiting it to the B, L, b, z and Z options for that purpose.
• Contributors extend coverage, since language rules, additional scripts and documentation are welcome through a fork of the repository.
• It fits constrained environments, where a shell and GNU grep are the only real runtime requirements.

Getting started

Install with make userinstall or make install as a user or as root, but the README recommends cloning https://github.com/wireghoul/graudit instead, because the repository includes additional database rules not present in the distribution files and allows updates between releases. The clone is then added to PATH, with GRDIR set if it does not live in the home directory.

How it compares

graudit places itself alongside RATS, SWAAT and flaw-finder as a static analysis option, but takes a lighter route by keeping technical requirements to a minimum and remaining flexible. The trade is depth for portability: signature matching over raw source is easy to run and easy to extend, while those heavier applications aim at more structured analysis.

When to use it — and when not to

Adopting graudit means operating almost nothing beyond a shell, GNU grep and optionally a cloned signatures directory, but its output is a rough list of regular expression matches, so anyone who needs parsed, data-flow-aware results with few false positives should look elsewhere, and every hit must be triaged by hand. Self-hosters who want the fullest rule set should clone the repository rather than install from distribution files, which omit some databases. The README is brief and the project describes itself as a rough audit, so treat it as a screening step ahead of manual review rather than a source of confirmed findings.

git clone https://github.com/wireghoul/graudit

echo 'PATH="$HOME/graudit:${PATH:+:${PATH}}"; export PATH;' >> ~/.bashrc

export GRDIR=/path/to/graudit/signatures

graudit [opts] /path/to/scan

OPTIONS
  -d <dbname> database to use or /path/to/file.db (uses default if not specified)
  -A scan unwanted and difficult (ALL) files
  -x exclude these files (comma separated list: -x *.js,*.sql)
  -i case in-sensitive scan
  -c <num> number of lines of context to display before and after a match, default is 1

  -B suppress banner
  -L vim friendly lines
  -b colour blind friendly template
  -z suppress colors
  -Z high contrast colors
  
  -l lists databases available
  -v prints version number
  -h prints this help screen

echo 'GRARGS="-b -L"; export GRARGS' >> ~/.bashrc