wtf is gixy?

Gixy is a command-line tool from Yandex that analyzes Nginx configuration files for security problems. Nginx is a popular web server, and its configuration files control how the server handles requests, routes traffic, and sets HTTP headers. Misconfigured Nginx setups can introduce security vulnerabilities even when the application code itself is fine. Gixy reads your configuration file and flags specific patterns known to cause problems. The types of issues it currently checks for include server-side request forgery, HTTP splitting, problems with how referrer and origin headers are validated, misuse of the add_header directive, host header forgery, path traversal through misconfigured aliases, and multiline response headers. Each detected issue includes a description, a severity level, and a reference link with more details. The output shows which part of the configuration triggered the finding. You install Gixy with pip and run it from the command line, pointing it at your nginx.conf file. By default it looks for the configuration at /etc/nginx/nginx.conf, but you can specify any path. Individual checks can be skipped if you know they are not relevant for your setup. A Docker image is also available if you prefer not to install it locally, and you can mount your configuration file as a volume for analysis. The project was built and is maintained by Yandex. It is written in Python and tested on GNU/Linux. The README notes that other operating systems may have issues. New detection plugins can be contributed, and there is an open issue tracker for tracking planned additions.