Self-hosted code quality and security platform that scans projects for bugs, vulnerabilities and maintainability issues, with Quality Gates for CI pipelines.
11.1K2.2KJavaLGPL-3.0Updated yesterday
dvershinin/gixy
A static analyzer that scans NGINX configuration files for security misconfigurations and common performance pitfalls.
- Stars
- 1,187
- Forks
- 29
- Open issues
- 0
- Last commit
- yesterday
What is it?
Gixy parses NGINX configuration files and reports security misconfigurations without running the server. It is aimed at catching problems such as SSRF-prone proxy setups, HTTP response splitting from unsafe variables, host header spoofing, weak TLS settings, alias path traversal, and exposed server version information.
Beyond security checks, Gixy flags performance and maintainability issues like risky regular expressions that may cause ReDoS, `if` directives used inside locations, and missing resolvers for OCSP stapling. A NGINX CVE check can be enabled by passing the server version, and an auto-fix mode can apply certain corrections with backup files.
Gixy runs as a Python command-line tool installable via pip, Homebrew, RPM, Alpine, Arch AUR, or conda-forge, and is also available as a Docker image and as IDE plugins for VS Code and JetBrains products.
Key features
- 01Detects SSRF, HTTP splitting, and host spoofing risks in NGINX configs.
- 02Checks TLS settings, HSTS headers, and server version disclosure.
- 03Flags risky regular expressions that may cause ReDoS.
- 04Can check known NGINX CVEs when given a version number.
- 05Offers an auto-fix mode with optional .bak backups.
Use cases
- Auditing production NGINX configs before a deployment or security review.
- Adding NGINX config linting to a CI pipeline.
- Checking ingress controller configuration inside a Kubernetes cluster.
- Getting real-time NGINX security hints inside a JetBrains or VS Code editor.
Topics
FAQ
- What is gixy?
- A static analyzer that scans NGINX configuration files for security misconfigurations and common performance pitfalls. Gixy parses NGINX configuration files and reports security misconfigurations without running the server. It is aimed at catching problems such as SSRF-prone proxy setups, HTTP response splitting from unsafe variables, host header spoofing, weak TLS settings, alias path traversal, and exposed server version information.
- Is gixy free to use? What license does it have?
- gixy is open source under the Other license. Check the license terms before using it in commercial products.
- Is gixy still maintained?
- Actively maintained. The last commit to gixy was on Oct 20, 2026.
- What can I use gixy for?
- Auditing production NGINX configs before a deployment or security review. Adding NGINX config linting to a CI pipeline. Checking ingress controller configuration inside a Kubernetes cluster. Getting real-time NGINX security hints inside a JetBrains or VS Code editor.
- Where can I get gixy?
- The source code and installation instructions are on GitHub: https://github.com/dvershinin/gixy
Summary generated by AI from the project's README. GitHub stats refresh daily.
Related projects
Fast, open-source static analysis CLI that finds bugs and enforces coding standards using code-like patterns instead of regex or ASTs.
17.1K1.1KCLGPL-2.1Updated 2 days ago
A fast Go-based Dockerfile linter with 60+ best-practice rules, quality scoring, and security checks for secrets and ARG usage.
2257GoApache-2.0Updated 9 months ago
A CLI and agent skill that scans React codebases for state, performance, security, accessibility and maintainability issues.
15K490TypeScriptOtherUpdated 3 days ago
An extremely fast Python linter and code formatter written in Rust, with over 900 lint rules and Black-compatible formatting.
50.2K2.5KRustMITUpdated yesterday
A Rust-based toolchain for web projects that provides a formatter and linter for JavaScript, TypeScript, JSX, JSON, CSS and more, via CLI and LSP.
26K1.3KRustApache-2.0Updated 7 hours ago