varpost/Scout Security Scan
Find hardcoded secrets, injection flaws, missing security headers, and vulnerable dependencies. Free, static, no API keys.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| path | Path to scan, relative to the workspace. | no | . |
| fail-on | Fail the action when findings at or above this severity exist: critical | high | medium | low | never. | no | high |
| format | Output format: sarif | json | markdown. | no | sarif |
| upload-sarif | Upload results to GitHub Code Scanning (job needs `security-events: write`). Only applies when format is sarif. | no | true |
| install | pip requirement to install (advanced — this repo's CI dogfoods a source checkout with '.'). | no | scout-security |
Outputs
| name | description |
|---|---|
| sarif-file | Path to the generated SARIF file (when format is sarif). |
| exit-code | Scout's exit code: 0 clean or below threshold, 1 findings at/above threshold. |