npm
github/codeql-action
Actions for running CodeQL analysis
MITSep 12, 2026 · metrics 2.10.0
All tags
Catalogue tag
#code-scanning
Every repository in the public record carrying this tag — from its GitHub topics or the keywords its package registries publish. Health is measured under the same versioned methodology as the rest of the record.
11 records
PyPI · crates.io
duriantaco/skylos
Open source local-first PR scanner that finds dead code, security bugs, secrets, quality regressions, and AI-code mistakes before merge. For first timers refer to https://duriantaco.github.io/skylos/repo-map/
Apache-2.0Sep 15, 2026 · metrics 2.10.0
PyPI
cpeoples/ansible-security-scanner
🛡️ Static security scanner (SAST) for Ansible playbooks, roles, and collections. 1,000+ rules across 30+ categories detecting malicious code, RCE, hardcoded credentials, and supply-chain risk. Outputs SARIF, CycloneDX SBOM, and GitLab SAST. SLSA Build Level 3, Sigstore-signed.
Apache-2.0Sep 9, 2026 · metrics 2.10.0
Packagist
laminas/laminas-code
Extensions to the PHP Reflection API, static code scanning, and code generation
BSD-3-ClauseAug 27, 2026 · metrics 2.10.0
Go
draugr-dev/draugr
Run Trivy, Semgrep, Gitleaks and more from one file. Consolidates SAST, SCA, secrets, IaC and container findings into one SARIF report and one pass/fail gate for CI — ranked by real risk, and can fail a PR on new findings only.
Apache-2.0Sep 11, 2026 · metrics 2.10.0
PyPI
justinchuby/lintrunner-adapters
Adapters and tools for lintrunner
Custom licenseSep 12, 2026 · metrics 2.10.0
npm
vaultcompasshq/conductor
Umbrella installer and combined report over the independently installable guardrail gates
MITSep 14, 2026 · metrics 2.10.0
—
G-Research/fsharp-analyzers
Analyzers for F#
Apache-2.0Sep 7, 2026 · metrics 2.10.0
Go
git-pkgs/sarif
Go library for reading, writing, and validating SARIF 2.1.0 logs
MITSep 8, 2026 · metrics 2.10.0
npm
subodhkc/mcp-tenant-isolation
Static analysis scanner for multi-tenant SaaS and MCP server code. 57 deterministic rules for cross-tenant data leakage, IDOR, RLS, and MCP-specific risks. Includes MCP server, SARIF output, and GitHub Action.
MITSep 20, 2026 · metrics 2.10.0
Go
SVGreg/surfaceguard
Know what you're letting in — scans, signs and verifies what an agent loads. Agent Skills vs the OWASP Agentic Skills Top 10, with SARIF output and a load-time gate.
Apache-2.0Sep 14, 2026 · metrics 2.10.0