Free GitHub Action that scans your repos for secrets, vulnerabilities, and misconfigurations. Automated security on every push.
# .github/workflows/security.yml name: Security Scan on: push: branches: [main] pull_request: branches: [main] jobs: security: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - uses: h2security/scanner@v1
Why Use It
Add one file to your repo. Get security scanning on every push.
Automatically find API keys, passwords, tokens, and credentials before they leak.
Scan npm, pip, and Go dependencies for known vulnerabilities.
Get scan results posted directly to your pull requests for easy review.
Typically completes in under 2 minutes. Won't slow down your CI/CD.
Markdown reports with all findings. Download as artifacts for compliance.
MIT licensed. Free forever. No signup, no tracking, no BS.
Scan Coverage
Powered by Gitleaks
npm audit, pip-audit, govulncheck
Powered by Trivy
Free vs Pro
The free scanner covers basics. Our agents go deeper.
| Feature | Free Scanner | AI Agents |
|---|---|---|
| Secret scanning | ✓ | ✓ |
| Dependency audit | ✓ | ✓ |
| Container scanning | ✓ | ✓ |
| AI-powered analysis | - | ✓ |
| Remediation guidance | - | ✓ |
| SAST/DAST | - | ✓ |
| Compliance mapping (SOC2, CIS) | - | ✓ |
| Pentest methodology | - | ✓ |
| Interactive chat | - | ✓ |
Get AI-powered security agents with pentest methodology, compliance mapping, and interactive guidance.