H2 Security Documentation

Welcome to H2 Security documentation. Learn how to secure your code with our AI-powered security scanning tools.

What is H2 Security?

H2 Security provides automated security scanning for your codebase. Our scanner detects vulnerabilities across multiple layers:

• Secret Detection - API keys, tokens, credentials
• Dependency Scanning - Known vulnerabilities in packages (via OSV)
• Container Security - Dockerfile misconfigurations
• SAST - Static analysis for Python, JavaScript, Go
• Infrastructure as Code - Terraform, Kubernetes security

Quick Start

Add H2 Scanner to your GitHub workflow:

name: Security Scan

on: [push, pull_request]

jobs:
  security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: h2security/scanner@v1
        with:
          scan-secrets: true
          scan-dependencies: true
          fail-on: critical

Features

Feature	Description
Multi-layer scanning	Secrets, dependencies, containers, SAST, IaC
GitHub Action	Native CI/CD integration
SARIF output	GitHub Security tab integration
CWE references	Links to detailed vulnerability info
Freemium model	Free tier with 10 findings, Pro for unlimited

Next Steps

• Quick Start Guide - Get running in 5 minutes
• GitHub Action Setup - Add to your CI/CD
• Configuration - Customize your scans