thejefflarson/Soundcheck Security Review
OWASP security review that comments a severity-ranked findings table on every PR, and can rewrite Critical/High/Medium findings in place.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| anthropic-api-key | Anthropic API key (use a repository secret) | yes | — |
| github-token | GitHub token with pull-requests:write. Also contents:write if autofix is enabled so rewrites can be committed back to the branch. Use secrets.GITHUB_TOKEN for most repos. | yes | — |
| base-branch | Branch to diff against on PRs and open PRs into on scheduled runs (default: the repo's default branch) | no | ${{ github.event.repository.default_branch }} |
| model | Claude model to use for the review (accepts any value `claude -p --model` accepts: short alias like `sonnet`/`haiku` or a full model id) | no | sonnet |
| autofix | If true, grant the reviewer Edit access so it can rewrite vulnerable code. Requires github-token with contents:write. Default false; set to 'true' to opt in. | no | false |
| max-budget-usd | Aggregate spend cap (USD) across the review + any autofix pass | no | 5 |
| timeout-seconds | Subprocess timeout passed through to the reviewer CLI | no | 900 |
Outputs
| name | description |
|---|---|
| pr-url | URL of the opened/updated PR (scheduled runs) or the triggering PR (pull_request runs). Empty when nothing was posted. |
| findings-count | Total findings returned by the reviewer |
| exit-code | Exit code from the reviewer CLI (0 clean, 1 Critical/High findings, 2 infrastructure error) |