asamassekou10/Ship Safe Security Scan
Scan your codebase for secrets, vulnerabilities, CVEs, and misconfigurations with 16 AI security agents
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit May 20, 2026
- License
- MIT
Pinned Snippet
uses: asamassekou10/ship-safe@bdc59e22a0d511f16ad7648b97523313f4f03e09 # v9.3.2tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| path | Path to scan (default: repository root) | no | . |
| threshold | Minimum score to pass (0-100, default: 75) | no | 75 |
| fail-on | Fail on severity level: critical, high, medium, low (overrides threshold) | no | "" |
| sarif | Generate SARIF file and upload to GitHub Code Scanning | no | true |
| deep | Enable AI deep analysis (requires ANTHROPIC_API_KEY, OPENAI_API_KEY, or GOOGLE_AI_API_KEY) | no | false |
| deps | Audit dependency CVEs | no | true |
| baseline | Only report new findings (compare against baseline) | no | false |
| comment | Post scan summary as PR comment | no | true |
| token | GitHub token for PR comments and SARIF upload (default: github.token) | no | ${{ github.token }} |
Outputs
| name | description |
|---|---|
| score | Security score (0-100) |
| grade | Letter grade (A-F) |
| findings | Total number of findings |
| secrets | Number of secrets detected |
| vulns | Number of code vulnerabilities |
| cves | Number of dependency CVEs |
| sarif-file | Path to SARIF file (if generated) |
| report-url | URL to the scan report (if available) |