Trace dangerous flows
Opengrep supplies within-file dataflow. Rowan adds cross-file tracing for Python and JavaScript/TypeScript, with a bounded Go request-to-command and SQL path.
Rowan / Open source alpha
Follow the path from input to impact.
Rowan analyzes source code, dependencies, and model artifacts together. It follows data through code paths, identifies AI-specific security patterns, and shows the evidence behind each finding.
The scan
One report. Several kinds of evidence.
A pattern match is useful as a lead. A computed flow tells a different story. Rowan distinguishes them in the finding, so reviewers know where to start.
Read AI-specific surfaces
Rules cover model deserialization, agent tools, LLM output passed into dangerous APIs, prompt handling, and insecure framework configuration.
Check dependencies
Known package advisories are enriched with function-level reachability signals and exploit-probability data to help prioritize review.
Inspect model files
Static checks examine pickle-based checkpoints and other model formats for executable or suspicious content without loading the model.
Reviewable output
See what supports a finding.
Findings carry an evidence tier, from a pattern-only lead to a computed taint flow. The default view emphasizes actionable items; an audit view retains the full set. Export to SARIF, JSON, HTML, or text, with baseline support for existing codebases.
Example evidence path
- Source Request parameter enters a route
- Propagation Value passes to a helper in another file
- Sink Helper calls a network client with that value
Illustrative flow. A finding still needs human review in the application’s context.
Open release
Built to be inspected and extended.
Rowan is MIT-licensed and public as an alpha. Install it from PyPI as rowan-sast. It uses Opengrep as its analysis engine, which rowan install-engine downloads and checks against a pinned hash.
pipx install rowan-sast
rowan install-engine
rowan scan ./your-project
Local CLIScan source on your machine or in CI.
Standard outputSARIF, JSON, HTML, and text, plus a GitHub Action for code scanning.
Optional LLM review
rowan hunt works with a local model or a cloud key.