passive-coder/SecureScope
Context-aware security analysis for open-source dependencies. Gates merges and emits SARIF.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jun 14, 2026
- License
- None
Pinned Snippet
uses: passive-coder/securescope@c82a1579e80b974850ac5ca4c4ff9ed9163f55fa # no releases — HEAD as of 2026-07-11tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| repository | Path, owner/repo, or Git URL to scan. Defaults to the checked-out workspace. | no | . |
| branch | Branch to scan when a remote repository is given. | no | "" |
| fail-on | Severity that fails the gate: critical, high, medium, low, or none. | no | high |
| sarif-file | Path (relative to the workspace) for the generated SARIF report. | no | securescope.sarif |
| offline | Skip OSV.dev network lookups and use the bundled rule pack only. | no | false |
Outputs
| name | description |
|---|---|
| verdict | Gate verdict: pass, warn, or fail. |
| score | Security posture score (0-100). |
| findings | Total number of findings. |
| critical | Number of critical findings. |
| high | Number of high findings. |
| reachable | Number of reachable findings. |
| sarif-file | Path to the generated SARIF file. |