nox-hq/Nox Security Scanner

Language-agnostic security scanner with first-class AI application security. Produces SARIF, SBOM, and AI inventory reports.

Trust Signals

name	description	required	default
path	Directory to scan	no	.
format	Output format(s): json, sarif, cdx, spdx, all (comma-separated)	no	sarif
output	Output directory for reports	no	nox-results
version	Nox version to install (e.g., 0.1.0 or latest)	no	latest
fail-on-findings	Fail the step if findings are detected	no	true
annotate	Post inline PR annotations for findings	no	true
pr-comment	Post inline PR review comments with finding details	no	false
max-comments	Maximum number of inline PR comments to post	no	25
min-severity	Minimum severity for PR comments (critical, high, medium, low, info)	no	low
severity-threshold	Filter findings to those at or above this severity (critical, high, medium, low). Empty = no filter.	no	""
min-confidence	Filter findings to those at or above this confidence (high, medium, low). Drops lower-confidence heuristic findings. Empty = no filter.	no	""
vex	Path to OpenVEX waiver document (skips VEX-not-affected findings)	no	""
changed-since	Scan only files changed since this git ref (e.g. origin/main). Empty = full scan.	no	""
offline	Guarantee zero network: disable every feature that could make an outbound connection (no API, no token, no telemetry).	no	false
fail-on-degraded	Fail the step if any check could not complete (OSV lookup, plugin, lockfile parse). A scan that could not look is otherwise indistinguishable from one that found nothing.	no	false

name	description
findings-count	Number of findings detected
sarif-file	Path to results.sarif (if generated)
findings-file	Path to findings.json (if generated)
exit-code	Raw nox exit code (0 = no findings, 1 = findings, 2 = error, or an incomplete check under fail-on-degraded)