glferreira-devsecops/Cascavel Header Guard
Audit HTTP security headers of any URL. Checks HSTS, CSP, X-Frame-Options, and 15+ headers with scoring.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| urls | Comma-separated URLs to scan (e.g., https://example.com,https://api.example.com) | yes | — |
| fail-score | Minimum passing score (0-100). Pipeline fails if any URL scores below this | no | 50 |
| fail-on-missing-critical | Fail if any critical header is missing (HSTS, CSP, X-Content-Type-Options) | no | true |
| timeout | HTTP request timeout in seconds | no | 10 |
| follow-redirects | Follow HTTP redirects | no | true |
| user-agent | Custom User-Agent string | no | Cascavel-HeaderGuard/1.0 (+https://rettecnologia.org) |
Outputs
| name | description |
|---|---|
| total-score | Average score across all scanned URLs (0-100) |
| worst-score | Lowest score among all scanned URLs |
| missing-critical | Number of missing critical headers across all URLs |
| report-path | Path to the detailed JSON report |