copenhagen0x/Solana Security Standard

Scan Solana/Anchor Rust code against the Solana Security Standard (SOL-0XX) — by Jelleo.

Trust Signals

name	description	required	default
paths	Files or directories to scan (space-separated). Do NOT wire this from untrusted PR data.	no	.
fail-on-findings	Fail the check (red X) when findings are present.	no	true
upload-sarif	Upload results to GitHub code scanning for inline PR annotations (needs `security-events: write`).	no	true
patterns	Path to a custom rules.json (default: the bundled SOL-0XX rules).	no	""
min-tier	Report only findings at/above this value tier: "high" drops LOW-tier hygiene/operational noise — concretely, SOL-003/018/022/023/030 disappear from both the annotations and the gate; "low" (or empty, the default) reports everything. A noise floor, NOT a verdict — not for audit-grade scans. Invalid values fail the run (the scanner exits 2), never silently scan with no floor. Safe to set statically; like all inputs, do not wire it from untrusted PR data.	no	""
baseline	Path to a committed baseline file (create with `npx @jelleo/solana-security-standard scan . --write-baseline <file>`): only findings NOT in it are reported and gated, so CI alerts on what a change introduces. Suppressed/stale counts are always surfaced; a malformed or missing baseline fails the run (exit 2), never silently scans without it. The baseline lives in the scanned checkout — review baseline diffs in PRs like code (every entry must carry its rule/file snapshot; a minimized entry is rejected at load).	no	""

no outputs