| api-key | API key for the model provider (OpenAI, DeepSeek, etc.) | no | — |
| anthropic-api-key | Anthropic API key (deprecated: use api-key instead) | no | — |
| provider | Model provider: anthropic, openai, deepseek, or openai-compatible. Defaults to anthropic if omitted. | no | anthropic |
| base-url | Custom base URL for openai-compatible providers (e.g. http://localhost:11434/v1 for Ollama) | no | "" |
| github-token | GitHub token for API access | yes | ${{ github.token }} |
| repositories | JSON array of repositories to monitor (e.g., [{"owner":"expressjs","repo":"express"}]) | yes | — |
| state-file | Path to state file for tracking last checked commits | no | .vulnerability-spoiler-state.json |
| create-issues | Whether to create GitHub issues for detected vulnerabilities | no | true |
| issue-repo | Repository to create issues in (defaults to current repository) | no | "" |
| model | Model to use for analysis (e.g. claude-sonnet-4-6, gpt-4o, deepseek-chat). Must match your provider. | no | claude-sonnet-4-6 |
| max-commits | Maximum number of commits to analyze per repository per run | no | 50 |
| enable-repo-context | Fetch modified files for context (max 3 files, 3000 chars each) | no | false |
| enable-judge | Review detections with second model (only runs on positives) | no | false |
| judge-model | Model for judge (empty = same as primary model; uses the same provider) | no | "" |
| max-concurrency | Maximum number of commits to analyze in parallel per repository | no | 3 |
| path-filter | Comma-separated path prefixes; only analyze commits that touch at least one matching file (empty = analyze all) | no | "" |
| skip-authors | Comma-separated author name substrings to skip (e.g. "[bot],dependabot") | no | "" |
| llm-timeout-seconds | Seconds before an LLM API call is aborted and retried | no | 60 |