chrysalisms/Secret Squirrel — Credential Scanner
GPU-accelerated, AI-powered credential and secret scanner. Scans your repository for hardcoded secrets, API keys, and credentials with minimal false positives. Outputs SARIF for GitHub Security dashboard.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| scan-mode | Scan mode: 'diff' (changed files only, fast), 'full' (entire repo), or 'history' (full git history). | no | diff |
| config-path | Path to a custom Squirrel/Betterleaks/Gitleaks TOML rule file. If not set, the embedded default rules are used. | no | "" |
| severity-threshold | Minimum severity to report. One of: info, low, medium, high, critical. | no | medium |
| fail-on-findings | Exit with a non-zero code if any findings are reported at or above the severity threshold. Set to 'false' to report-only without failing CI. | no | true |
| validate | Attempt active validation of discovered credentials against their respective services (AWS, GitHub, etc.). Adds network calls. | no | false |
| sarif-upload | Upload the SARIF report to the GitHub Code Scanning dashboard. Requires github-token with security_events write permission. | no | true |
| model-tier | ML model tier for CNN-based false-positive reduction. Options: default (Markov only), tiny (500K CNN), large (1M CNN), enhanced (TinyBERT), maximum (DistilBERT). | no | tiny |
| github-token | GitHub token for SARIF upload and authenticated API access. Defaults to the built-in GITHUB_TOKEN secret. | no | ${{ github.token }} |
Outputs
| name | description |
|---|---|
| findings-count | Total number of findings at or above the severity threshold. |
| sarif-path | Absolute path to the generated SARIF file. |