cparnin/AppSec Galaxy Scan

AI-powered application security scanning with cross-file attack-chain analysis

Trust Signals

name	description	required	default
ai-provider	AI provider: 'openai' (default) or 'anthropic'	no	openai
openai-api-key	OpenAI API key used by AI scanning and remediation (AI_PROVIDER=openai)	no	—
anthropic-api-key	Anthropic API key used by AI scanning and remediation (AI_PROVIDER=anthropic)	no	—
ai-model	Optional model override; defaults to the selected scan depth for the provider	no	""
auto-fix	Enable automatic remediation and PR creation	no	true
auto-fix-mode	Specific auto-fix mode: 1=SAST+secrets, 2=dependencies, 3=both, 4=skip (overrides auto-fix if set)	no	""
fail-on-critical	Fail the workflow if critical vulnerabilities are found	no	false
scan-level	Scan level: critical-high or all	no	critical-high
code-quality	Enable code quality and maintainability scanning (in addition to security)	no	true
dependency-analysis	Enable dependency code-path analysis (traces usage, health, depth)	no	true
ai-scan	Enable AI-native deep analysis for logic errors, auth bypasses, and race conditions	no	false
ai-scan-depth	AI scan depth: quick, standard, or deep	no	standard
ai-scan-tier	AI data privacy tier: 1 = no AI calls, 2 = finding metadata only (no source code), 3 = full source files (default). Tiers 1 and 2 disable AI deep analysis and AI code fixes.	no	3
ai-scan-max-cost	Hard USD ceiling for the AI scanner phase (e.g. "1.00"); the scan stops issuing AI calls at the cap. Empty = no cap.	no	""

name	description
total-findings	Total number of security findings
critical-findings	Number of critical severity findings
high-findings	Number of high severity findings
secrets-found	Number of secrets detected
report-path	Path to the generated security report
sbom-generated	Whether SBOM was successfully generated (true/false)