glferreira-devsecops/Cascavel Secret Scanner
Find hardcoded API keys, tokens, and credentials in your code. 40+ patterns. Zero config. SARIF output.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| path | Root path to scan | no | . |
| severity | Minimum severity threshold: low, medium, high, critical | no | medium |
| fail-on-findings | Exit with error code if secrets are found (blocks the pipeline) | no | true |
| exclude-paths | Comma-separated glob patterns to exclude | no | .git,node_modules,vendor,__pycache__,.venv,dist,build,*.min.js,*.min.css,*.lock,package-lock.json,*.svg,*.png,*.jpg,*.gif,*.ico,*.woff,*.woff2,*.ttf,*.eot |
| custom-patterns | Path to a custom patterns JSON file | no | "" |
| sarif-output | Generate SARIF report for GitHub Security tab | no | true |
| max-file-size | Maximum file size to scan in KB (skip large binaries) | no | 512 |
| scan-history | Also scan git history for leaked secrets (slower) | no | false |
| baseline-file | Path to baseline file to suppress known findings | no | "" |
Outputs
| name | description |
|---|---|
| findings-count | Total number of secrets detected |
| critical-count | Number of critical severity findings |
| high-count | Number of high severity findings |
| sarif-path | Path to the generated SARIF report |
| report-path | Path to the JSON findings report |