Analyzers

CodeGuard uses a shared project scan, detector, configuration, rule engine, and analysis result model. Enabled analyzers do not execute analyzed source code.

TypeScript

When tsconfig.json is available, the TypeScript Compiler API reports project diagnostics without emitting output. Compiler access is constrained to scanned project files, permitted project configuration/declaration files, and the TypeScript standard library.

JavaScript and JSX

The JavaScript analyzer reports syntax diagnostics for .js and .jsx files. When project configuration enables checkJs, it can also return semantic diagnostics. It honors jsconfig.json and TypeScript project settings where applicable.

Security

SEC001–SEC005 report potentially risky constructs. Findings are warnings and should be reviewed in context. Credential-like values are never included in security rule finding messages; MCP compiler diagnostic strings receive additional redaction.

Architecture

ARCH001 reports strongly connected groups of local modules. ARCH002 reports unresolved relative imports and configured path aliases when resolution is reliable. External package names are not treated as local imports.

Resource and resolution limitations

The default scanner skips files larger than 1 MiB, ignores common dependency/generated/secret paths, limits directory traversal to 64 levels and 100,000 encountered directory entries, and rejects scans that exceed the 20,000 supported-file cap. JavaScript type diagnostics depend on project compiler settings. Alias handling does not model every TypeScript package export or inherited configuration scenario.