Book a Security Review

The scanner

H2 Security Scanner

974 rules. 15 languages. Four scan types.

SAST, IAST, DAST, and WAF assessment with bypass detection. Runs in your CI as a GitHub Action. Results land in the pull request and in the GitHub Security tab as SARIF.

Talk to us
.github/workflows/security.yml
- name: H2 Security Scan
  uses: h2security/scanner@v1
  with:
    target: ${{ github.workspace }}
    api-key: ${{ secrets.H2_API_KEY }}
974Rules
15Languages
4Scan Modes
CI/CDGitHub Action

Capabilities

What the Scanner Finds

Secret Detection

Hardcoded API keys, tokens, passwords, and credentials in your source code. Catches what .gitignore misses.

Vulnerability Scanning

SQL injection, XSS, SSRF, command injection, and hundreds more. Mapped to CWE and OWASP Top 10.

Dependency Audit

Known CVEs in your dependencies. License compliance. Outdated packages with available fixes.

WAF Assessment

Test your web application firewall rules. Detect bypasses before attackers do.

Configuration Analysis

Infrastructure-as-code misconfigurations. Terraform, Kubernetes manifests, Docker files.

Compliance Mapping

Findings mapped to SOC2, CIS, and OWASP frameworks. Audit-ready reports.

Scan Types

Four Ways to Test

SAST

Static Analysis

Analyze source code without executing it. Finds injection flaws, hardcoded secrets, insecure patterns.

IAST

Interactive Analysis

Runtime instrumentation during testing. Combines the depth of SAST with the context of DAST.

DAST

Dynamic Analysis

Test running applications from the outside. Discovers vulnerabilities visible in production.

WAF

WAF Assessment

Evaluate your WAF rules against real attack payloads. Find gaps in your edge protection.

Coverage

Language & Rule Coverage

Language Coverage

JavaScriptTypeScriptPythonJavaGoRubyPHPC#C/C++RustKotlinSwiftScalaTerraformDockerfile
974

Security rules across supported scan modes.

Framework Coverage

CWEOWASP Top 10SOC2CIS

Integration

Add to Your Pipeline in Minutes

  1. 01

    Add the GitHub Action

    Drop the H2 Scanner action into your workflow file. One YAML block.

  2. 02

    Push or Open a PR

    The scanner runs automatically on every push and pull request. Results posted as PR comments.

  3. 03

    Review in the Pull Request

    Findings in the pull request and the GitHub Security tab. Prioritized by severity, mapped to CWE and the frameworks you report against.

Secure your code on every push.

Add the scanner to your pipeline today.

Talk to us