Safe AST-based transformations • NIST/OWASP/CIS compliant • Zero telemetry
The problem: PowerShell scripts are prone to security vulnerabilities (hardcoded credentials, command injection, weak crypto) and quality issues (missing error handling, inconsistent formatting). Manual fixes are time-consuming and error-prone.
The solution: PoshGuard uses AST-based analysis to automatically detect and fix security vulnerabilities and code quality issues in PowerShell scripts—preserving your code's intent while enforcing best practices.
- DevOps engineers automating infrastructure and deployments
- Security teams enforcing NIST, OWASP, CIS, and ISO compliance
- IT administrators maintaining PowerShell scripts across Windows/Linux/macOS
- Compliance officers requiring auditable security standards
- RipGrep integration for 5-10x faster scanning on large codebases
- AST-based transformations preserve code intent (no regex hacks)
- Secrets hardening detects and fixes hardcoded credentials
- Compliance frameworks mapped to NIST, OWASP, CIS, ISO 27001, FedRAMP
- SARIF export for GitHub Code Scanning integration
- Cross-platform works on Windows, macOS, Linux (PowerShell 7+)
# Install from PowerShell Gallery
Install-Module -Name PoshGuard -Scope CurrentUser -Force
Import-Module PoshGuard
# Preview changes (dry run)
Invoke-PoshGuard -Path ./script.ps1 -DryRun -ShowDiff
# Apply fixes to entire directory
Invoke-PoshGuard -Path ./scripts -Recurse
# Fast scan with RipGrep (5-10x faster)
Invoke-PoshGuard -Path ./large-codebase -Recurse -FastScan# Clone repository
git clone https://github.com/cboyd0319/PoshGuard.git
cd PoshGuard
# Run directly from source
./tools/Apply-AutoFix.ps1 -Path ./samples/before-security-issues.ps1 -ShowDiff# Generate SARIF report for GitHub Security tab
Invoke-PoshGuard -Path . -DryRun -ExportSarif -SarifOutputPath ./poshguard-results.sarif
# Upload SARIF to GitHub (via GitHub Actions)
# See docs/reference/GITHUB-SARIF-INTEGRATION.mdWhat it does:
- Scans PowerShell scripts for security issues
- Shows diff of proposed changes
- Applies fixes automatically (preserving intent)
- Generates SARIF reports for GitHub
New to PoshGuard? Follow the documentation index
|
Security Scanning
RipGrep Integration (NEW)
Code Quality
|
Compliance Frameworks
GitHub Integration
Cross-Platform Support
Developer Experience
|
| Tool | Version | Purpose | Required |
|---|---|---|---|
| PowerShell | ≥ 7.0 | Runtime (Windows/macOS/Linux) | Yes |
| PSGallery | N/A | Module installation | Yes |
| RipGrep | ≥ 14.0 | Fast pre-filtering (5-10x speedup) | No (optional) |
# Windows
choco install ripgrep
# Or: winget install BurntSushi.ripgrep.MSVC
# macOS
brew install ripgrep
# Linux (Ubuntu/Debian)
apt install ripgrep
# Verify installation
rg --versionFor large codebases with thousands of PowerShell scripts, enable RipGrep pre-filtering:
# Standard scan (full AST analysis on all files)
Invoke-PoshGuard -Path ./enterprise-scripts -Recurse
# Fast scan (5-10x faster with RipGrep)
Invoke-PoshGuard -Path ./enterprise-scripts -Recurse -FastScan- RipGrep pre-filtering - Quickly identifies scripts with security patterns (credentials, Invoke-Expression, etc.)
- AST analysis - Only candidate files undergo expensive parsing
- Skip safe files - Clean scripts are skipped entirely
| Codebase Size | Standard Scan | Fast Scan | Speedup |
|---|---|---|---|
| 1,000 scripts | ~48s | ~9s | 5.3x |
| 10,000 scripts | ~480s | ~52s | 9.2x |
See RipGrep Integration Guide for advanced usage.
PoshGuard uses sensible defaults. Advanced configuration available via:
config/PSScriptAnalyzerSettings.psd1- PSScriptAnalyzer rulesconfig/QASettings.psd1- Quality assurance settingsconfig/SecurityRules.psd1- Security rule mappingsconfig/poshguard.json- Main configuration
See Configuration Guide for details.
Error: Module not found
Cause: PoshGuard not installed or not imported
Fix:
# Install from Gallery
Install-Module -Name PoshGuard -Scope CurrentUser -Force
# Import module
Import-Module PoshGuard
# Verify installation
Get-Module PoshGuard -ListAvailableSlow performance on large codebases
Cause: Full AST analysis on all files
Fix: Enable Fast Scan mode with RipGrep:
# Install RipGrep first (see prerequisites)
Invoke-PoshGuard -Path ./large-repo -Recurse -FastScanSARIF export fails
Cause: Invalid output path or permissions
Fix:
# Ensure directory exists
New-Item -ItemType Directory -Force -Path ./reports
# Export with full path
Invoke-PoshGuard -Path . -DryRun -ExportSarif -SarifOutputPath ./reports/poshguard.sarifMore help:
- Documentation Index - Complete documentation map
- Architecture Guide - System design and data flow
- Checks & Fixes - Security rules and transformations
- API Reference - Command reference
- RipGrep Integration - Fast scanning for large codebases
- GitHub SARIF Integration - Code Scanning setup
- Configuration Guide - Customizing rules and settings
- Changelog - Release history and updates
- Troubleshooting - Common issues and solutions
MIT License - See LICENSE for full text.
✅ Commercial use allowed
✅ Modification allowed
✅ Distribution allowed
✅ Private use allowed
📋 License and copyright notice required
TL;DR: Use it however you want. Just include the license.
Learn more: https://choosealicense.com/licenses/mit/
Need help?
- 🐛 File a bug report
- 💡 Request a feature
- 💬 Ask a question
- 🔒 Report a security issue (private)
Resources:
If PoshGuard helps secure your PowerShell scripts, give us a star ⭐
Active Development • Production-Ready • Community-Driven
Made with ❤️ for PowerShell developers who value security