raccioly/websec-validator

Local-first security recon that briefs your AI coding agent — SARIF for Code Scanning, can gate PRs on new findings.

Trust Signals

name	description	required	default
path	Path to the repo/subdir to scan.	no	.
scan	Also execute the available static scanners (Trivy/Gitleaks/Semgrep/…) if present.	no	false
fail-on	Fail the job if any finding at/above this severity remains (critical\|high\|medium\|low). Empty = never fail (report-only).	no	""
baseline	Optional prior findings-ledger.json — gate only on findings NEW since this baseline.	no	""
upload-sarif	Upload results.sarif to the GitHub Security tab (Code Scanning).	no	true
out	Output directory.	no	websec-out

no outputs