m1rl0k/GoSecretScan
Fast secret scanner with 189+ patterns. Scans files & git history for API keys, tokens, and credentials.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| scan-path | Directory path to scan for secrets (default: current directory) | no | . |
| fail-on | Minimum confidence level to fail: low, medium, high, critical (default: low = fail on any secret) | no | low |
| output-format | Output format: text, json, or sarif (default: text) | no | text |
| sarif-file | Path to write SARIF output (for GitHub Security tab integration) | no | "" |
| no-git-history | Skip scanning git commit history (default: false, scans entire history) | no | false |
| git-max-commits | Maximum commits to scan in git history (0 = all) | no | 0 |
| config | Path to config file (.gosecretscanner.json) | no | "" |
| baseline | Path to baseline file for suppressing known findings | no | "" |
| redact | Redact secret values in output (default: true) | no | true |
| enable-llm | Enable LLM-powered verification for fewer false positives (requires Docker) | no | false |
| model-path | Path to the Granite GGUF model (relative to repo by default) | no | .gosecretscanner/models/granite-4.0-micro-Q4_K_M.gguf |
| llm-endpoint | HTTP endpoint for llama.cpp server (defaults to localhost) | no | "" |
| llm-port | Host port to expose the llama.cpp server on | no | 8080 |
| llama-image | Docker image to launch llama.cpp server | no | ghcr.io/ggerganov/llama.cpp:server |
| manage-llm-server | Start/stop the llama.cpp server inside this action (set to false when using an external service). | no | true |
Outputs
| name | description |
|---|---|
| secrets-found | Number of secrets found during the scan |
| scan-status | Status of the scan (success or failed) |
| sarif-file | Path to SARIF output file (if generated) |