ActionRank
Check your actions

VulnHawk Security Scan

Actively maintained

momenbasel/vulnhawk

AI-powered SAST scanner that finds auth bypass, IDOR, and logic bugs Semgrep/CodeQL miss. Free GitHub Action. Supports Python, JS/TS, Go, PHP, Ruby.

★ 77 starsLast commit 1 months agoLatest v0.2.0
C
66
/ 100
Security 75Maintenance 79Popularity 27Reliability 70

Security signals

OpenSSF ScorecardNo data
SECURITY.md presentYes
Immutable releasesNot enabled
Known vulnerabilitiesNone on record

How to use it safely

Recommended: pin to commit SHA
uses: momenbasel/vulnhawk@b878413216e94ba3d6e634c9bf9920578f198ca0 # v0.2.0

Mutable tags like v0.2.0 can be rewritten to point at malicious commits. Pinning to the full commit SHA is the only reference GitHub guarantees immutable.

Full workflow example
steps:
  - uses: momenbasel/vulnhawk@b878413216e94ba3d6e634c9bf9920578f198ca0 # v0.2.0

Score breakdown

Security (35%)75
Popularity (20%)27
Maintenance (30%)79
Reliability (15%)70