Automated security scanning for every push, every PR
SecureOps is a free, open-source GitHub Action that performs automated security scanning on repositories. It detects secrets, vulnerabilities, and misconfigurations using Gitleaks, Trivy, and OSV-Scanner. Generates multi-format reports and integrates with GitHub Security tab. Available on GitHub at github.com/cloudon-one/git-security-scanner-public.
Core Features
Secret Detection
Catch exposed API keys, passwords, and tokens before they reach production.
- Powered by Gitleaks v8.28.0
- Custom rule definitions via TOML configuration
- Token masking in reports (first/last 4 chars)
- Supports pre-commit and CI/CD scanning
Vulnerability Scanning
Find CVEs and security issues in dependencies and infrastructure code.
- Trivy v0.65.0 for CVE and misconfiguration detection
- OSV-Scanner v2.2.1 for open source vulnerability identification
- Scans application dependencies, container images, and IaC
- Fail-on-critical build policies
Rich Reporting
Actionable reports in multiple formats, integrated directly into your GitHub workflow.
- JSON, HTML, and SARIF output formats
- Automated PR comments with severity breakdown
- GitHub Security tab integration via SARIF upload
- Multi-factor risk scoring and assessment
How It Works
Add the GitHub Action
Add SecureOps to your workflow YAML with a single step. Configure scan type, fail thresholds, and reporting options.
Scan on Every Push
SecureOps runs automatically on pushes and pull requests, scanning for secrets, vulnerabilities, and misconfigurations.
Review Findings
Findings appear as PR comments with severity levels and remediation guidance. Critical issues can block merges.
Org-Wide Audits
Run scheduled scans across your entire GitHub organization with consolidated dashboards and Slack summaries.
Why Choose SecureOps?
Shift-Left Security
Catch security issues in development, not production. Automated scanning on every commit prevents secrets from ever reaching your main branch.
Zero Configuration Start
Works out of the box with sensible defaults. Just add the action to your workflow and start scanning immediately.
Supply Chain Security
SHA256 checksum verification prevents tool tampering. Non-root container execution and minimal attack surface.
Developer-Friendly
Findings appear directly in PR comments with severity, context, and remediation guidance. No context switching to external dashboards.
Tech Stack
Frequently Asked Questions
How do I add SecureOps to my repository?
What types of security issues does SecureOps detect?
Can SecureOps scan my entire GitHub organization?
Is SecureOps free for private repositories?
What report formats are supported?
Other CloudOn Tools
KubeLaunch
KubeLaunch Essentials is a free, open-source Kubernetes platform with integrated security, observability, and service mesh. It deploys a security-hardened EKS cluster via Terraform/Terragrunt with ArgoCD, Kyverno, Falco, Istio, and Kubecost pre-configured. Available on GitHub at github.com/cloudon-one/kubelaunch-essentials.
Learn moreMulti-Cloud Runway
Multi-Cloud Runway is a free, open-source infrastructure template providing security-hardened landing zones for AWS and GCP. It sets up multi-account environments with networking, IAM, security monitoring, and compliance via Terraform/Terragrunt. Available on GitHub at github.com/cloudon-one/multi-cloud-runway.
Learn moreFinOps Guardian
FinOps Guardian is a free, open-source cost governance toolkit for AWS and GCP. It automatically detects idle resources, provides cost-saving recommendations, and cleans up unused infrastructure. Deployed with Terraform, it runs serverlessly on Lambda and Cloud Functions. Available on GitHub at github.com/cloudon-one/FinOps-Guardian.
Learn more