Quick Start
Get H2 Security Scanner running in under 5 minutes.
GitHub Action (Recommended)
The fastest way to add security scanning to your repository:
1. Create Workflow File
Create .github/workflows/security.yml:
name: H2 Security Scan
on:
push:
branches: [main]
pull_request:
branches: [main]
jobs:
security:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Run H2 Security Scanner
uses: h2security/scanner@v1
with:
scan-secrets: true
scan-dependencies: true
scan-containers: true
scan-sast: true
scan-iac: true
fail-on: critical
2. Push and Run
Commit and push your changes. The scanner will run on every push and pull request.
3. View Results
Results appear in:
- Workflow logs - Detailed findings with code snippets
- PR comments - Summary of security issues
- Security tab - SARIF integration (with
output: sarif)
What Gets Scanned
| Scanner | What it checks |
|---|---|
| Secrets | API keys, tokens, passwords, credentials |
| Dependencies | Known CVEs in npm, pip, go, cargo, etc. |
| Containers | Dockerfile security best practices |
| SAST | Code vulnerabilities in Python, JS, Go |
| IaC | Terraform, Kubernetes misconfigurations |
Example Output
╔═══════════════════════════════════════════════════════════════╗
║ H2 SECURITY SCANNER ║
╚═══════════════════════════════════════════════════════════════╝
● Secrets Detection... 2 found
● Dependency Vulnerabilities... 1 found
● Container Security... ok
● Python SAST... 3 found
● JavaScript SAST... ok
● Go SAST... ok
● Infrastructure as Code... ok
─────────────────────────────────────────────────────────────────
FINDINGS (6 total)
─────────────────────────────────────────────────────────────────
[CRITICAL] Hardcoded AWS Secret Key
File: config/settings.py:42
CWE: CWE-798 /cwe/CWE-798.html
Fix: Use environment variables or secrets manager
[HIGH] SQL Injection Vulnerability
File: api/users.py:156
CWE: CWE-89 /cwe/CWE-89.html
Fix: Use parameterized queries