| audit_level | The value of `--audit-level` flag | no | low |
| create_issues | Flag to create issues when vulnerabilities are found | no | true |
| create_pr_comments | Flag to create pr comments when vulnerabilities are found | no | true |
| fail_on_vulnerabilities | Fail the action when vulnerabilities are found | no | true |
| dedupe_comments | Skip commenting on the existing issue when the report is unchanged from the last one posted by this action. Effective only with dedupe_issues | no | false |
| dedupe_issues | Flag to de-dupe against open issues | no | false |
| github_token | GitHub Access Token. | yes | — |
| ignore_ghsas | GHSA advisory IDs to exclude from the pass/fail decision (comma, space, or newline separated). If every advisory found is ignored, the action reports no vulnerabilities and creates no issue or comment | no | — |
| issue_assignees | Issue assignees (separated by commma) | no | — |
| issue_labels | Issue labels (separated by commma) | no | — |
| issue_title | Issue title | no | npm audit found vulnerabilities |
| issue_type | Issue type (e.g. Bug, Task). Requires issue types to be enabled on the organization | no | — |
| json_flag | Run `npm audit` with `--json` | no | false |
| production_flag | Run `npm audit` with `--omit=dev` | no | false |
| report_format | Format of the report posted to issues and PR comments: text (npm audit output in a code block) or markdown (summary and table built from the JSON report; forces `--json`) | no | text |
| resolve_pr_comments | Edit previous report comments on the pull request to mark them resolved when vulnerabilities are no longer found. Effective only with create_pr_comments | no | false |
| registry | The registry URL passed to `npm audit` via the `--registry` flag (e.g. https://registry.npmjs.org) | no | — |
| working_directory | The directory which contains package.json | no | — |