socketdev/Socket Basics Security Scanner
Comprehensive security scanning with SAST, secrets, container scanning, and more.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| workspace | Workspace directory to scan (defaults to GITHUB_WORKSPACE) | no | "" |
| changed_files | Diff-only mode: scope every scanner (SAST/OpenGrep, secrets, containers) to changed files only, instead of the whole repository. Accepts a comma-separated file list, a commit hash, 'auto' (diffs against the PR base branch in CI, else staged changes), 'pr' (diff against GITHUB_BASE_REF), or 'current-commit'. For PR/'auto' modes, check out with actions/checkout fetch-depth: 0 so the base branch is available. When the diff resolves to no existing files (e.g. a delete-only PR) the scanners are skipped rather than scanning the whole repo. | no | "" |
| scan_files | Explicit comma-separated list of files to scan. Scopes SAST/OpenGrep, secret, and container scans to just these files. Used when changed_files is not set; changed_files takes precedence when both are provided. | no | "" |
| socket_org | Socket organization slug (required for Enterprise features) | no | "" |
| socket_security_api_key | Socket Security API key (required for Enterprise features and Dashboard configuration) | no | "" |
| github_token | GitHub token for PR comments and API access | no | "" |
| GITHUB_API_URL | Github Api Url | no | "" |
| all_languages_enabled | Enable SAST for all supported languages | no | false |
| all_rules_enabled | Run all bundled SAST rules regardless of language filters | no | false |
| c_disabled_rules | Comma-separated list of C SAST rules to disable | no | "" |
| c_enabled_rules | Comma-separated list of C SAST rules to enable (default: high-confidence rules) | no | c-buffer-overflow,c-format-string-vulnerability,c-command-injection,c-sql-injection,c-use-after-free,c-hardcoded-secrets,c-weak-crypto,c-ssl-issues |
| c_sast_enabled | Enable C SAST scanning | no | false |
| container_images | Comma-separated list of container images to scan (auto-enables image scanning) | no | "" |
| custom_sast_rule_path | Relative path to custom SAST rules directory (relative to workspace if set, otherwise cwd) | no | custom_rules |
| cpp_disabled_rules | Comma-separated list of C++ SAST rules to disable | no | "" |
| cpp_enabled_rules | Comma-separated list of C++ SAST rules to enable (default: high-confidence rules) | no | c-buffer-overflow,c-format-string-vulnerability,c-command-injection,c-sql-injection,c-use-after-free,c-hardcoded-secrets,c-weak-crypto,c-ssl-issues,cpp-unsafe-cast,cpp-memory-management |
| cpp_sast_enabled | Enable C++ SAST scanning | no | false |
| csharp_disabled_rules | Comma-separated list of C# SAST rules to disable | no | "" |
| csharp_enabled_rules | Comma-separated list of C# SAST rules to enable (default: high-confidence rules) | no | dotnet-sql-injection,dotnet-command-injection,dotnet-code-injection,dotnet-unsafe-deserialization,dotnet-ldap-injection,dotnet-hardcoded-credentials,dotnet-ssl-bypass,dotnet-xxe-vulnerability,dotnet-xpath-injection |
| csharp_sast_enabled | Enable C# SAST scanning | no | false |
| disable_all_secrets | Disable all secret scanning features | no | false |
| dockerfiles | Comma-separated list of Dockerfiles to scan (auto-enables Dockerfile scanning) | no | "" |
| dotnet_disabled_rules | Comma-separated list of .NET SAST rules to disable | no | "" |
| dotnet_enabled_rules | Comma-separated list of .NET SAST rules to enable (default: high-confidence rules) | no | dotnet-sql-injection,dotnet-command-injection,dotnet-code-injection,dotnet-unsafe-deserialization,dotnet-ldap-injection,dotnet-hardcoded-credentials,dotnet-ssl-bypass,dotnet-xxe-vulnerability,dotnet-xpath-injection |
| dotnet_sast_enabled | Enable .NET SAST scanning | no | false |
| elixir_disabled_rules | Comma-separated list of Elixir SAST rules to disable | no | "" |
| elixir_enabled_rules | Comma-separated list of Elixir SAST rules to enable (default: high-confidence rules) | no | elixir-code-injection,elixir-sql-injection,elixir-command-injection,elixir-unsafe-deserialization,elixir-hardcoded-secrets,elixir-phoenix-ecto-injection |
| elixir_sast_enabled | Enable Elixir SAST scanning | no | false |
| erlang_sast_enabled | Enable Erlang SAST scanning | no | false |
| go_disabled_rules | Comma-separated list of Go SAST rules to disable | no | "" |
| go_enabled_rules | Comma-separated list of Go SAST rules to enable (default: high-confidence rules) | no | go-hardcoded-credentials,go-bind-all-interfaces,go-unsafe-usage,go-ssh-insecure-ignore-host-key,go-profiling-endpoint-exposed,go-decompression-bomb,go-sql-format-string |
| go_sast_enabled | Enable Go SAST scanning | no | false |
| golang_sast_enabled | Enable Golang SAST scanning | no | false |
| java_disabled_rules | Comma-separated list of Java SAST rules to disable | no | "" |
| java_enabled_rules | Comma-separated list of Java SAST rules to enable (default: high-confidence rules) | no | java-sql-injection,java-unsafe-deserialization,java-command-injection,java-ldap-injection,java-hardcoded-credentials,java-weak-crypto-md5,java-weak-crypto-sha1,java-xxe-vulnerability,java-ssl-bypass,java-weak-ssl-version,java-jndi-injection,java-el-injection |
| java_sast_enabled | Enable Java SAST scanning | no | false |
| javascript_disabled_rules | Comma-separated list of JavaScript/TypeScript SAST rules to disable | no | "" |
| javascript_enabled_rules | Comma-separated list of JavaScript/TypeScript SAST rules to enable (default: high-confidence rules) | no | js-eval-usage,js-sql-injection,js-command-injection,js-prototype-pollution,js-xss-innerhtml,js-path-traversal,js-tls-reject-unauthorized-false,js-weak-crypto-md5 |
| javascript_sast_enabled | Enable JavaScript/TypeScript SAST scanning | no | false |
| sast_ignore_overrides | Comma-separated list of SAST ignore overrides in rule_id or rule_id:path format | no | "" |
| jira_api_token | Jira Api Token | no | "" |
| jira_email | Jira Email | no | "" |
| kotlin_disabled_rules | Comma-separated list of Kotlin SAST rules to disable | no | "" |
| kotlin_enabled_rules | Comma-separated list of Kotlin SAST rules to enable (default: high-confidence rules) | no | kotlin-sql-injection,kotlin-command-injection,kotlin-code-injection,kotlin-unsafe-deserialization,kotlin-hardcoded-secrets,kotlin-ssl-bypass,kotlin-xxe-vulnerability,kotlin-ldap-injection |
| kotlin_sast_enabled | Enable Kotlin SAST scanning | no | false |
| ms_sentinel_key | Ms Sentinel Key | no | "" |
| ms_sentinel_workspace_id | Ms Sentinel Workspace Id | no | "" |
| msteams_webhook_url | MS Teams incoming webhook URL (also reads MSTEAMS_WEBHOOK_URL or INPUT_MSTEAMS_WEBHOOK_URL) | no | "" |
| notification_method | Notification method for TruffleHog (e.g., console, slack) | no | "" |
| php_disabled_rules | Comma-separated list of PHP SAST rules to disable | no | "" |
| php_enabled_rules | Comma-separated list of PHP SAST rules to enable (default: high-confidence rules) | no | php-code-injection,php-sql-injection,php-command-injection,php-unsafe-deserialization,php-ldap-injection,php-file-inclusion,php-xxe-vulnerability,php-hardcoded-secrets,php-path-traversal |
| php_sast_enabled | Enable PHP SAST scanning | no | false |
| project | Project | no | "" |
| python_disabled_rules | Comma-separated list of Python SAST rules to disable | no | "" |
| python_enabled_rules | Comma-separated list of Python SAST rules to enable (default: high-confidence rules) | no | python-exec-used,python-bad-file-permissions,python-hardcoded-password-string,python-eval-usage,python-request-without-cert-validation,python-ssl-bad-version,python-subprocess-shell-true,python-start-process-with-shell,python-sql-injection-format,python-flask-debug-true,python-jinja2-autoescape-false |
| python_sast_enabled | Enable Python SAST scanning | no | false |
| ruby_disabled_rules | Comma-separated list of Ruby SAST rules to disable | no | "" |
| ruby_enabled_rules | Comma-separated list of Ruby SAST rules to enable (default: high-confidence rules) | no | ruby-eval-injection,ruby-command-injection,ruby-sql-injection,ruby-unsafe-deserialization,ruby-hardcoded-secrets,ruby-ssl-verification-bypass,ruby-rails-find-by-sql-injection,ruby-rails-unsafe-constantize,ruby-xxe-vulnerability |
| ruby_sast_enabled | Enable Ruby SAST scanning | no | false |
| rust_disabled_rules | Comma-separated list of Rust SAST rules to disable | no | "" |
| rust_enabled_rules | Comma-separated list of Rust SAST rules to enable (default: high-confidence rules) | no | rust-command-injection,rust-unsafe-deserialization,rust-sql-injection,rust-hardcoded-secrets,rust-insecure-tls,rust-buffer-overflow-potential |
| rust_sast_enabled | Enable Rust SAST scanning | no | false |
| scala_disabled_rules | Comma-separated list of Scala SAST rules to disable | no | "" |
| scala_enabled_rules | Comma-separated list of Scala SAST rules to enable (default: high-confidence rules) | no | scala-sql-injection,scala-code-injection,scala-command-injection,scala-unsafe-deserialization,scala-hardcoded-secrets,scala-ssl-bypass,scala-slick-sql-injection |
| scala_sast_enabled | Enable Scala SAST scanning | no | false |
| secret_scanning_enabled | Enable secret scanning | no | false |
| server | Server | no | "" |
| slack_webhook_url | Slack webhook URL (also reads SLACK_WEBHOOK_URL or INPUT_SLACK_WEBHOOK_URL) | no | "" |
| socket_additional_params | Additional CLI params for 'socket scan reach' (comma or space separated). Also reads SOCKET_ADDITIONAL_PARAMS | no | "" |
| socket_tier_1_enabled | Enable Socket Tier 1 reachability analysis | no | false |
| sumologic_endpoint | Sumologic Endpoint | no | "" |
| swift_disabled_rules | Comma-separated list of Swift SAST rules to disable | no | "" |
| swift_enabled_rules | Comma-separated list of Swift SAST rules to enable (default: high-confidence rules) | no | swift-sql-injection,swift-command-injection,swift-unsafe-deserialization,swift-hardcoded-secrets,swift-ssl-bypass,swift-insecure-urlsession,swift-certificate-pinning-bypass |
| swift_sast_enabled | Enable Swift SAST scanning | no | false |
| trivy_disabled_rules | Comma-separated list of Trivy rules to disable. Trivy-backed scanning is temporarily unavailable in the pre-built GitHub Action image. | no | "" |
| trivy_image_scanning_disabled | Disable Trivy image scanning. Trivy-backed scanning is temporarily unavailable in the pre-built GitHub Action image. | no | false |
| trivy_notification_method | Notification method for Trivy (e.g., console, slack). Trivy-backed scanning is temporarily unavailable in the pre-built GitHub Action image. | no | "" |
| trivy_vuln_enabled | Enable Trivy vulnerability scanning for all supported language ecosystems. Trivy-backed scanning is temporarily unavailable in the pre-built GitHub Action image. | no | false |
| trufflehog_exclude_dir | Comma-separated list of directories to exclude from secret scanning | no | "" |
| trufflehog_show_unverified | Show unverified secrets in TruffleHog results | no | false |
| use_custom_sast_rules | Use custom SAST rules instead of bundled rules (falls back to bundled rules for languages without custom rules) | no | false |
| webhook_url | Generic webhook URL for WebhookNotifier | no | "" |
| pr_comment_links_enabled | Enable clickable file/line links in PR comments | no | true |
| pr_comment_collapse_enabled | Enable collapsible sections in PR comments | no | true |
| pr_comment_collapse_non_critical | Auto-collapse non-critical findings (critical stays expanded) | no | true |
| pr_comment_code_fencing_enabled | Enable language-aware code fencing for trace output | no | true |
| pr_comment_show_rule_names | Show explicit rule names for each finding | no | true |
| pr_labels_enabled | Add severity-based labels to PRs | no | true |
| pr_label_critical | Label name for critical severity findings | no | security: critical |
| pr_label_high | Label name for high severity findings | no | security: high |
| pr_label_medium | Label name for medium severity findings | no | security: medium |
| pr_label_low | Label name for low severity findings | no | security: low |
Outputs
no outputs