e-volv

Security playbook

Secret&SecurityScan

Scans PR diffs for committed secrets — API keys, tokens, private keys — before merge.

On a pull request, scans the diff for accidentally-committed secrets (API keys, tokens, private keys, connection strings) and high-signal insecure code patterns (eval on user input, SQL built by string concatenation, disabled TLS verification, weak crypto). Posts inline review findings with severity and submits a non-blocking review. Advisory — a security complement to code review, not a replacement for a dedicated scanner.

Identifier
secret-security-scan
Version
1.1.0
Steps
4
Triggers
2
  • security
  • secrets
  • review
  • vulnerabilities
  • automated

When it runs

Pull requestpull_request.opened
Settle delay
30s after the event

Only when all hold

  • pullRequest.isDraft not equals true
  • actor.username not contains [bot]
Pull requestpull_request.synchronize
Settle delay
60s after the event

Only when all hold

  • pullRequest.isDraft not equals true
  • actor.username not contains [bot]

The pipeline

The graph below is the one the workflow opens with in the builder — same steps, same layout, drawn on the same canvas. The run playing through it is a simulation; the branches and conditions are real.

React Flow
  1. 01
    PR Opened / Updatedtrigger

    The event that starts the run.

  2. 02
    Clone Repositorygit.clone

    Shallow-clones the repository at the right ref.

  3. 03
    Scan for Secrets & Vulnerabilitiesagent.run

    One agent works the task with its toolkit.

  4. 04
    Publish Security Scan Reportreport.publish

    Posts or updates a deduplicated report comment.

The agent

Security Scanner

Base type
Code Reviewer
Temperature
0.1
Max iterations
30
Tools
7

Git provider · 3

  • get_pull_request_diffGet Pull Request Diff · read
  • add_pull_request_review_threadAdd PR Review Thread · write
  • submit_reviewSubmit Review · write

Filesystem · 2

  • read_fileRead File · read
  • list_dirList Directory · read

Code search · 1

  • code_searchCode Search · read

Status · 1

  • update_statusUpdate Status · write