code-scanning

⚙️ Scan your Go, Java, Kotlin, PHP, Python, JavaScript, TypeScript, .NET projects at GitHub with Qodana. This repository contains Qodana for Azure, GitHub, CircleCI and Gradle

🚀 GitHub action for running gitleaks/gitleaks (no license key is required)

DISM Final Year Project, Security Software Tool Development, CodeQL Scanner

Advanced Conftest GitHub Action for Terraform, Kubernetes, Helm & Dockerfile policy scanning with SARIF, GitHub Security, Slack, Teams and Google Chat notifications.

Open-source, local-first privacy code scanner for PII leaks, hardcoded secrets, GDPR/CCPA compliance, SARIF, and CI/CD

AI-assisted code security scanner - zero-dependency static analysis + entropy-based secret detection + SARIF output + GitHub Action

Offline scanner for AI agent instruction files (AGENTS.md, CLAUDE.md, .cursorrules, skills, MCP configs) — flags prompt-injection payloads, hidden Unicode, encoded blobs, exfiltration and permission-bypass patterns. Zero dependencies, zero network calls.

Static analysis for AI automation workflows. Find prompt-injection paths, overpowered tools, and write-capable agent jobs before they run.

GitHub Action for automating Boom Token workflows using JavaScript. This action simplifies tasks like smart contract interactions, token analytics, and liquidity management for Boom Token on multiple networks.

GitHub Advanced Security Code Scanning demo using WebGoat, a deliberate insecure web application maintained by OWASP designed to teach web application security lessons.

Read-only scanner for what lets a repository run code in a coding agent (Claude Code, Codex, Cursor, Copilot): git settings, hooks, and committed MCP server definitions and agent settings. SARIF output. No dependencies, no network, no telemetry.

Secret scanner that runs in your browser and in CI from the same scan.js. Paste code or drop files and it reports leaked API keys, tokens and private-key blocks, with the value redacted; nothing is uploaded. Also ships a Node CLI and a GitHub Action with SARIF output.

Review agent-generated security-fix pull requests with alert traceability, CodeQL and behavioral evidence, scope-risk gates, and human-owned merge decisions.

Scan anything before you paste it into an LLM. Catches leaked API keys, tokens and PII. Zero dependencies, offline, one-way redaction.

Security & reliability audit for vibe-coded apps (Lovable / Bolt.new / v0 / Cursor): exposed keys, missing RLS, browser-direct AI calls, config smells, live-site checks. Zero-dependency CLI.

Free static security scanner for Next.js + Supabase apps, as a GitHub Action.

DSH plugin — active-defense security patrol powered by SSH + Semgrep. 集扫描、远程执行、结构化报告于一体的 DSH 主动安全巡逻插件。

A GitHub Security Lab initiative, providing an in-repo learning experience, where learners secure intentionally vulnerable code. [CLONE/TEMPLATE]

Zero-dependency MCP/Agent security scanner — 30+ rules for prompt injection, tool abuse & secret leakage. Drop-in CI gate.

Free local-first GitHub Actions YAML security preflight + scoped paid workflow remediation