code-scanning

⚙️ Scan your Go, Java, Kotlin, PHP, Python, JavaScript, TypeScript, .NET projects at GitHub with Qodana. This repository contains Qodana for Azure, GitHub, CircleCI and Gradle

🚀 GitHub action for running gitleaks/gitleaks (no license key is required)

DISM Final Year Project, Security Software Tool Development, CodeQL Scanner

Advanced Conftest GitHub Action for Terraform, Kubernetes, Helm & Dockerfile policy scanning with SARIF, GitHub Security, Slack, Teams and Google Chat notifications.

Open-source, local-first privacy code scanner for PII leaks, hardcoded secrets, GDPR/CCPA compliance, SARIF, and CI/CD

Offline scanner for AI agent instruction files (AGENTS.md, CLAUDE.md, .cursorrules, skills, MCP configs) — flags prompt-injection payloads, hidden Unicode, encoded blobs, exfiltration and permission-bypass patterns. Zero dependencies, zero network calls.

Static analysis for AI automation workflows. Find prompt-injection paths, overpowered tools, and write-capable agent jobs before they run.

GitHub Advanced Security Code Scanning demo using WebGoat, a deliberate insecure web application maintained by OWASP designed to teach web application security lessons.

GitHub Action for automating Boom Token workflows using JavaScript. This action simplifies tasks like smart contract interactions, token analytics, and liquidity management for Boom Token on multiple networks.

Read-only scanner for what lets a repository run code in a coding agent (Claude Code, Codex, Cursor, Copilot): git settings, hooks, and committed MCP server definitions and agent settings. SARIF output. No dependencies, no network, no telemetry.

AI-assisted code security scanner - zero-dependency static analysis + entropy-based secret detection + SARIF output + GitHub Action

100% client-side secret scanner - a dependency-free, zero-upload browser port of the wrg-devguard scan engine. Paste code or drop files; nothing leaves your browser. Also ships a Node CLI and a GitHub Action with SARIF output for code scanning.

A GitHub Security Lab initiative, providing an in-repo learning experience, where learners secure intentionally vulnerable code. [CLONE/TEMPLATE]

Review agent-generated security-fix pull requests with alert traceability, CodeQL and behavioral evidence, scope-risk gates, and human-owned merge decisions.

Scan anything before you paste it into an LLM. Catches leaked API keys, tokens and PII. Zero dependencies, offline, one-way redaction.

Security & reliability audit for vibe-coded apps (Lovable / Bolt.new / v0 / Cursor): exposed keys, missing RLS, browser-direct AI calls, config smells, live-site checks. Zero-dependency CLI.

DSH plugin — active-defense security patrol powered by SSH + Semgrep. 集扫描、远程执行、结构化报告于一体的 DSH 主动安全巡逻插件。

ZeroPath plugin for AI code agents — bring AppSec scanning (SAST, secrets, SCA, IaC), finding triage, and security context into Claude Code from chat.

Free local-first GitHub Actions YAML security preflight + scoped paid workflow remediation

Audit GitHub Actions workflows for supply-chain risk