mattybellx/ansede-static

Minimal-dependency SAST scanner — detects IDOR, auth bypass, SQLi, path traversal, and 20+ categories. No GPU, no API keys.

Trust Signals

workflow.ymlSHA-pinned

uses: mattybellx/ansede@4852f588774d40de5d4d8d4d36c7a662b0c2d0f3 # v6.1.0

tags can be moved; commit SHAs can't. why a SHA?

name	description	required	default
path	File or directory to scan (default: current directory)	no	.
fail-on	Exit 1 when any finding at this severity or above is found (critical/high/medium/low/info/never)	no	high
format	Output format: text, json, or sarif	no	sarif
output	Write output to this file (stdout if omitted). Required for SARIF upload.	no	ansede.sarif
exclude	Comma-separated path patterns to exclude (e.g. "tests,migrations")	no	""
version	Optional version/ref. With install-source=pypi, install ansede-static==<version>; with install-source=github, install from that git ref.	no	""
install-source	Install source: pypi (default), github, or local	no	pypi
upload-sarif	Upload SARIF results to GitHub Code Scanning (requires contents:write and security-events:write permissions)	no	true
post-pr-comments	Post inline review comments on the PR for each finding (requires pull-requests:write permission). Only active on pull_request events.	no	true
min-confidence	Only report findings with confidence >= threshold (0.0-1.0). Default 0.65 reduces noise ~60% while keeping all HIGH/CRITICAL.	no	0.65
all-findings	Show all findings regardless of confidence score (overrides min-confidence).	no	false
noise-gate	Enforce a strict web-wild noise quotient ceiling (e.g., 2.0). Fails the CI if the false-positive rate exceeds this limit.	no	""
output-dir	Path to a directory to output multiple formats simultaneously in a single scan pass.	no	""
license-key	ansede-static Pro license key for SARIF/SBOM features	no	""

name	description
findings-count	Total number of findings across all files
sarif-file	Path to the generated SARIF file