Find real vulnerabilities.
Fix them instantly.
SiteShadow traces tainted data across functions and files to find SQL injection, XSS, command injection, and SSRF that regex scanners miss. 2,000+ rules. Auto-fix in your editor. GitHub Action for CI.
What regex scanners miss, SiteShadow catches
How it's different
Most SAST tools match text patterns. SiteShadow understands data flow.
AST-based taint tracking
Tree-sitter parses your code into an AST. Taint flows from sources (request.args, user input) through variables, function calls, and string operations to sinks (SQL, eval, exec). Sanitizers like int() and html.escape() break the chain.
Interprocedural analysis across functions
When get_input() returns tainted data and handle_request() passes it to SQL, SiteShadow follows the flow across function calls. Two-pass summary generation across Python, JavaScript, Go, Java, and C#.
Low false positives on sanitized code
Parameterized queries, parseInt(), shlex.quote(), DOMPurify.sanitize() — SiteShadow recognizes 30+ sanitizer patterns and stays quiet when code is safe.
Accuracy you can verify.
The OWASP Benchmark is the industry-standard test for SAST tools — 2,740 real Java vulnerability test cases across 11 CWE categories.
Our engine achieves a perfect score: 100% true positive rate, 0% false positive rate across all 7 CWE categories — outperforming every major enterprise SAST vendor on the benchmark, including Checkmarx, Fortify, Veracode, and graph-based ML tools like Qwiet AI.
Most vendors won't publish their score. We will.
Everything you need to ship secure code
Features
Taint Tracking
WASM-powered dataflow analysis across Python, JavaScript, Go, Java, and C#. Traces user input from 60+ sources through variables, f-strings, and method chains to 50+ dangerous sinks. 26+ sanitizer patterns eliminate false positives.
Instant Fixes
One-click code actions in VS Code / Cursor. Replaces hashlib.md5 with sha256, os.system with subprocess.run, hardcoded secrets with os.environ.
GitHub Action
Add uses: siteshadow/scan@v1 to your workflow. SARIF upload to Code Scanning, PR comments with severity table, delta reporting against baseline.
CVE Scanning
Checks requirements.txt and package.json against OSV.dev for known vulnerabilities. Shows CVE ID, CVSS score, and upgrade path.
Git History Secrets
Scans git commit history for API keys, tokens, and passwords that were deleted but still exist in git objects. 15 secret patterns + entropy detection.
IaC Scanning
Terraform, CloudFormation, Docker, Kubernetes, Helm, and GitHub Actions rules. Detects privileged containers, open security groups, script injection, and more.
Custom Rules (YAML)
Define your own taint sources, sinks, and sanitizers in YAML. Extend the engine for internal APIs without writing code.
Enterprise SSO
Okta and Azure AD single sign-on. Per-organization configuration with encrypted secrets. Break-glass emergency access.
Three ways to use SiteShadow
In your editor — VS Code / Cursor extension
cursor --install-extension siteshadow.vsixReal-time scanning, inline diagnostics, one-click fixes.
In your CI — GitHub Action
- uses: siteshadow/scan@v1
with:
api-key: ${{ secrets.SITESHADOW_API_KEY }}PR comments, SARIF upload, delta reporting.
On the command line — CLI scanner
python scan_cli.py ./src --format sarif --auto-fix-dry-runScan directories, generate SARIF, preview auto-fixes.
Who uses SiteShadow?
Community coming soon
Stay tuned
SiteShadow vs. the competition
vs. Semgrep
Semgrep requires learning a custom rule DSL. SiteShadow works out of the box with 2,000+ rules, interprocedural taint tracking, and one-click fixes in your editor.
vs. Snyk Code
Snyk's auto-fix only handles dependency upgrades. SiteShadow generates actual code fixes: parameterized queries, safe API replacements, env var migrations.
vs. CodeQL
CodeQL requires a build step and takes minutes. SiteShadow analyzes in milliseconds with no build required. Full SARIF output for GitHub Code Scanning.
Stop guessing. Start tracing.
SiteShadow follows your data from input to output. If it's safe, we stay quiet. If it's not, we show you exactly why and how to fix it.
Start scanning your code today
Free tier available. No credit card required. Install the extension, get an API key, and start finding real vulnerabilities in minutes.