north-human-ai/Nautillo Pro Security Scan

Automated web application security testing. Trigger a Nautillo Pro scan and fail the build on confirmed vulnerabilities.

Trust Signals

name	description	required	default
api-key	Nautillo Pro API key. Store as a repository secret (never hardcode).	yes	—
url	Target URL to scan.	yes	—
scan-type	"single_url" (default) or "full_domain". full_domain available on Professional (4/month, up to 1,000 pages) and Business (30/month, up to 5,000 pages).	no	single_url
fail-on	Minimum severity that fails the build: "critical" (default), "high", "medium", "low", or "none".	no	critical
timeout	Seconds to wait before the action times out. Default: 900 (15 min). full_domain scans can take several hours — set to 21600 and use continue-on-error with a webhook for large sites.	no	900
auth-type	Authentication method for scanning protected pages: "bearer", "basic", or "form". Omit for unauthenticated scans.	no	""
auth-token	Bearer token (when auth-type is "bearer"). Store as a secret.	no	""
auth-username	Username (when auth-type is "basic" or "form"). Store as a secret.	no	""
auth-password	Password (when auth-type is "basic" or "form"). Store as a secret.	no	""
auth-login-url	Login form URL (when auth-type is "form"). Example: https://staging.example.com/login	no	""
webhook-url	Optional webhook URL to receive a signed POST when the scan completes.	no	""
webhook-secret	HMAC secret for webhook signature verification. Omit to auto-generate.	no	""
api-url	Override the Nautillo Pro API base URL. Leave as default unless directed by support.	no	https://api.nautillo.pro/functions/v1

name	description
scan-id	UUID of the triggered scan.
report-url	URL to the full scan report on nautillo.pro.
status	Scan outcome: "passed", "failed", or "error".
exit-code	0 = no findings at threshold, 1 = findings at threshold, 2 = scan error or timeout.
critical	Number of confirmed Critical severity findings.
high	Number of confirmed High severity findings.
medium	Number of confirmed Medium severity findings.
low	Number of confirmed Low severity findings.
findings-json	JSON object with confirmed finding counts: {"critical":0,"high":2,"medium":3,"low":1}