bgage72590/XploitScan Security Scanner
Security scanner for AI-generated code. 30 core rules (210+ with Pro). Outputs SARIF for GitHub Security tab.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jun 29, 2026
- License
- MIT
Pinned Snippet
uses: bgage72590/xploitscan-action@dc061478e55d49820721017649a3732db4c67196 # v1.3.2tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| path | Path to scan (default: current directory) | no | . |
| fail-on | Fail the action if findings of this severity or higher are found: critical, high, medium, low, none (default: none) | no | none |
| sarif-file | Path to write SARIF output (default: xploitscan-results.sarif) | no | xploitscan-results.sarif |
| comment | Post a summary comment on pull requests (default: true) | no | true |
| api-key | XploitScan API key (xpls_...) — generate one in Settings → API Keys. Required to unlock the full 210+ rule Pro set; without it the action runs the 30 free rules. | no | "" |
| anthropic-api-key | Optional Anthropic API key. When set, findings are run through XploitScan's AI false-positive filter (uses Claude Haiku, ~$0.01 per scan). Reduces noise on CI runs. Get one at https://console.anthropic.com. | no | "" |
Outputs
| name | description |
|---|---|
| grade | Security grade (A+ to F) |
| score | Security score (0-100) |
| findings-count | Total number of findings |
| critical-count | Number of critical findings |
| high-count | Number of high findings |
| medium-count | Number of medium findings |
| low-count | Number of low findings |
| sarif-file | Path to the SARIF output file |