piotrmackowski/ClosedSSPM
Audit SaaS platforms for security misconfigurations. Open source SSPM with 166+ checks across ServiceNow, Snowflake, Entra ID, and Google Workspace.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jun 30, 2026
- License
- Apache 2.0
Pinned Snippet
uses: piotrmackowski/closedsspm@064f4a96ce21ff65a4a3d3b87659517367709bc8 # v0.4.2tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| platform | SaaS platform to audit: servicenow, snowflake, entra, or googleworkspace | no | servicenow |
| format | Report format: html, json, csv, or sarif | no | sarif |
| fail-on | Fail (exit 2) if findings at or above this severity: CRITICAL, HIGH, MEDIUM, LOW, INFO, or none | no | none |
| instance | ServiceNow instance URL (e.g. https://mycompany.service-now.com). Pass via secrets. | no | — |
| username | ServiceNow username for basic auth. Pass via secrets. | no | — |
| password | ServiceNow password for basic auth. Pass via secrets. | no | — |
| client-id | ServiceNow OAuth 2.0 client ID. Pass via secrets. | no | — |
| client-secret | ServiceNow OAuth 2.0 client secret. Pass via secrets. | no | — |
| private-key | ServiceNow RSA private key PEM content for JWT key pair auth. Pass via secrets. | no | — |
| key-id | ServiceNow Key ID from JWT Verifier Map. Pass via secrets. | no | — |
| jwt-user | ServiceNow username for JWT sub claim (cannot be admin). Pass via secrets. | no | — |
| snowflake-account | Snowflake account identifier (e.g. xy12345.us-east-1). Pass via secrets. | no | — |
| snowflake-user | Snowflake username. Pass via secrets. | no | — |
| snowflake-password | Snowflake password for basic auth. Pass via secrets. | no | — |
| snowflake-private-key | Snowflake RSA private key PEM content for key pair auth. Pass via secrets. | no | — |
| snowflake-pat | Snowflake programmatic access token. Pass via secrets. | no | — |
| snowflake-token | Snowflake OAuth access token. Pass via secrets. | no | — |
| snowflake-role | Snowflake role to assume (default: SECURITYADMIN) | no | — |
| snowflake-warehouse | Snowflake warehouse for queries (default: COMPUTE_WH) | no | — |
| snowflake-database | Snowflake database (default: SNOWFLAKE for ACCOUNT_USAGE views) | no | — |
| entra-tenant-id | Azure AD / Entra ID tenant ID. Pass via secrets. | no | — |
| entra-client-id | Entra ID app registration client ID. Pass via secrets. | no | — |
| entra-client-secret | Entra ID app registration client secret. Pass via secrets. | no | — |
| entra-certificate | Entra ID PEM certificate content for client assertion auth. Pass via secrets. | no | — |
| gw-access-token | Google Workspace OAuth2 bearer token. Pass via secrets. | no | — |
| gw-credentials-json | Google Workspace service account JSON key content. Pass via secrets. | no | — |
| gw-delegated-user | Google Workspace super admin email for domain-wide delegation. Pass via secrets. | no | — |
| gw-use-adc | Use Application Default Credentials for Google Workspace (true/false). Pass via secrets. | no | — |
Outputs
| name | description |
|---|---|
| report-path | Path to the generated report file |
| finding-count | Total number of findings |
| posture-score | Posture score grade (A-F) |
| sarif-path | Path to SARIF file (only when format=sarif) |