Secret Detection
Hardcoded API keys, tokens, passwords, and credentials in your source code. Catches what .gitignore misses.
H2 Security Platform
H2 Security Scanner
974 rules. 15 languages. Four scan types.
SAST, IAST, DAST, and WAF assessment with bypass detection. Integrated into your CI/CD pipeline via GitHub Action. Results delivered to your H2 Platform dashboard.
.github/workflows/security.yml
- name: H2 Security Scan
uses: h2security/scanner@v1
with:
target: ${{ github.workspace }}
api-key: ${{ secrets.H2_API_KEY }}974Rules
15Languages
4Scan Modes
CI/CDGitHub Action
Capabilities
What the Scanner Finds
Vulnerability Scanning
SQL injection, XSS, SSRF, command injection, and hundreds more. Mapped to CWE and OWASP Top 10.
Dependency Audit
Known CVEs in your dependencies. License compliance. Outdated packages with available fixes.
WAF Assessment
Test your web application firewall rules. Detect bypasses before attackers do.
Configuration Analysis
Infrastructure-as-code misconfigurations. Terraform, Kubernetes manifests, Docker files.
Compliance Mapping
Findings mapped to SOC2, CIS, and OWASP frameworks. Audit-ready reports.
Scan Types
Four Ways to Test
SAST
Static Analysis
Analyze source code without executing it. Finds injection flaws, hardcoded secrets, insecure patterns.
IAST
Interactive Analysis
Runtime instrumentation during testing. Combines the depth of SAST with the context of DAST.
DAST
Dynamic Analysis
Test running applications from the outside. Discovers vulnerabilities visible in production.
WAF
WAF Assessment
Evaluate your WAF rules against real attack payloads. Find gaps in your edge protection.
Coverage
Language & Rule Coverage
Language Coverage
JavaScriptTypeScriptPythonJavaGoRubyPHPC#C/C++RustKotlinSwiftScalaTerraformDockerfile
974
Security rules across supported scan modes.
Framework Coverage
CWEOWASP Top 10SOC2CIS
Integration
Add to Your Pipeline in Minutes
- 01
Add the GitHub Action
Drop the H2 Scanner action into your workflow file. One YAML block.
- 02
Push or Open a PR
The scanner runs automatically on every push and pull request. Results posted as PR comments.
- 03
Review in Dashboard
Full findings in your H2 Platform dashboard. Prioritized by severity, mapped to frameworks.
PLANS
Scanner Plans
Part of the H2 Security Platform. Choose the plan that fits your team.
Recon
Individual practitioners
$49/mo$399/year
- 10 scans/month
- 1 target
- Core modules (secrets, deps, SAST)
- Dashboard access
- Community support
MOST POPULAR
Strike
Security engineers, small teams
$149/mo$1,299/year
- 50 scans/month
- 5 targets
- All modules + WAF
- PR comments
- Priority support (48hr SLA)
Arsenal
Security teams
$299/mo$2,899/year
- Unlimited scans
- 25 targets
- All modules
- Team seats
- API access
- Priority support (24hr SLA)
Fortress
Enterprise
$599/moCustom annual
- Unlimited everything
- Unlimited targets
- Dedicated account manager
- Custom integrations
- SLA guarantees
- On-call support