├── .github ├── dependabot.yml └── workflows │ ├── docker.yml │ ├── octoscan.yml │ └── release.yml ├── .gitignore ├── .golangci.yml ├── .pre-commit-config.yaml ├── Dockerfile ├── LICENSE ├── README.md ├── cmd ├── download.go └── scan.go ├── common ├── assets │ └── sarif.template ├── helpers.go └── logger.go ├── core ├── downloader.go ├── linter.go └── rules │ ├── assets │ └── ghsa.json │ ├── helpers.go │ ├── init.go │ ├── rule_bot_check.go │ ├── rule_dangerous_action.go │ ├── rule_dangerous_artefact.go │ ├── rule_dangerous_checkout.go │ ├── rule_dangerous_write.go │ ├── rule_debug_artefacts.go │ ├── rule_debug_external_trigger.go │ ├── rule_debug_js_exec.go │ ├── rule_debug_oidc.go │ ├── rule_expression_injection.go │ ├── rule_known-vulnerability.go │ ├── rule_local_action.go │ ├── rule_repojacking.go │ ├── rule_runner_label.go │ └── rule_runner_unsecure_commands.go ├── go.mod ├── go.sum ├── img ├── AcalaNetwork.png ├── alibaba.png ├── ant-design.png ├── autogpt.png ├── dependabot.png ├── excalidraw.png ├── haskell.png ├── swagger.png └── test.png └── octoscan.go /.github/dependabot.yml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/synacktiv/octoscan/HEAD/.github/dependabot.yml -------------------------------------------------------------------------------- /.github/workflows/docker.yml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/synacktiv/octoscan/HEAD/.github/workflows/docker.yml -------------------------------------------------------------------------------- /.github/workflows/octoscan.yml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/synacktiv/octoscan/HEAD/.github/workflows/octoscan.yml -------------------------------------------------------------------------------- /.github/workflows/release.yml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/synacktiv/octoscan/HEAD/.github/workflows/release.yml -------------------------------------------------------------------------------- /.gitignore: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/synacktiv/octoscan/HEAD/.gitignore -------------------------------------------------------------------------------- /.golangci.yml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/synacktiv/octoscan/HEAD/.golangci.yml -------------------------------------------------------------------------------- /.pre-commit-config.yaml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/synacktiv/octoscan/HEAD/.pre-commit-config.yaml -------------------------------------------------------------------------------- /Dockerfile: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/synacktiv/octoscan/HEAD/Dockerfile -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/synacktiv/octoscan/HEAD/LICENSE -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/synacktiv/octoscan/HEAD/README.md -------------------------------------------------------------------------------- /cmd/download.go: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/synacktiv/octoscan/HEAD/cmd/download.go -------------------------------------------------------------------------------- /cmd/scan.go: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/synacktiv/octoscan/HEAD/cmd/scan.go -------------------------------------------------------------------------------- /common/assets/sarif.template: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/synacktiv/octoscan/HEAD/common/assets/sarif.template -------------------------------------------------------------------------------- /common/helpers.go: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/synacktiv/octoscan/HEAD/common/helpers.go -------------------------------------------------------------------------------- /common/logger.go: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/synacktiv/octoscan/HEAD/common/logger.go -------------------------------------------------------------------------------- /core/downloader.go: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/synacktiv/octoscan/HEAD/core/downloader.go -------------------------------------------------------------------------------- /core/linter.go: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/synacktiv/octoscan/HEAD/core/linter.go -------------------------------------------------------------------------------- /core/rules/assets/ghsa.json: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/synacktiv/octoscan/HEAD/core/rules/assets/ghsa.json -------------------------------------------------------------------------------- /core/rules/helpers.go: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/synacktiv/octoscan/HEAD/core/rules/helpers.go -------------------------------------------------------------------------------- /core/rules/init.go: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/synacktiv/octoscan/HEAD/core/rules/init.go -------------------------------------------------------------------------------- /core/rules/rule_bot_check.go: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/synacktiv/octoscan/HEAD/core/rules/rule_bot_check.go -------------------------------------------------------------------------------- /core/rules/rule_dangerous_action.go: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/synacktiv/octoscan/HEAD/core/rules/rule_dangerous_action.go -------------------------------------------------------------------------------- /core/rules/rule_dangerous_artefact.go: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/synacktiv/octoscan/HEAD/core/rules/rule_dangerous_artefact.go -------------------------------------------------------------------------------- /core/rules/rule_dangerous_checkout.go: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/synacktiv/octoscan/HEAD/core/rules/rule_dangerous_checkout.go -------------------------------------------------------------------------------- /core/rules/rule_dangerous_write.go: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/synacktiv/octoscan/HEAD/core/rules/rule_dangerous_write.go -------------------------------------------------------------------------------- /core/rules/rule_debug_artefacts.go: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/synacktiv/octoscan/HEAD/core/rules/rule_debug_artefacts.go -------------------------------------------------------------------------------- /core/rules/rule_debug_external_trigger.go: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/synacktiv/octoscan/HEAD/core/rules/rule_debug_external_trigger.go -------------------------------------------------------------------------------- /core/rules/rule_debug_js_exec.go: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/synacktiv/octoscan/HEAD/core/rules/rule_debug_js_exec.go -------------------------------------------------------------------------------- /core/rules/rule_debug_oidc.go: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/synacktiv/octoscan/HEAD/core/rules/rule_debug_oidc.go -------------------------------------------------------------------------------- /core/rules/rule_expression_injection.go: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/synacktiv/octoscan/HEAD/core/rules/rule_expression_injection.go -------------------------------------------------------------------------------- /core/rules/rule_known-vulnerability.go: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/synacktiv/octoscan/HEAD/core/rules/rule_known-vulnerability.go -------------------------------------------------------------------------------- /core/rules/rule_local_action.go: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/synacktiv/octoscan/HEAD/core/rules/rule_local_action.go -------------------------------------------------------------------------------- /core/rules/rule_repojacking.go: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/synacktiv/octoscan/HEAD/core/rules/rule_repojacking.go -------------------------------------------------------------------------------- /core/rules/rule_runner_label.go: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/synacktiv/octoscan/HEAD/core/rules/rule_runner_label.go -------------------------------------------------------------------------------- /core/rules/rule_runner_unsecure_commands.go: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/synacktiv/octoscan/HEAD/core/rules/rule_runner_unsecure_commands.go -------------------------------------------------------------------------------- /go.mod: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/synacktiv/octoscan/HEAD/go.mod -------------------------------------------------------------------------------- /go.sum: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/synacktiv/octoscan/HEAD/go.sum -------------------------------------------------------------------------------- /img/AcalaNetwork.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/synacktiv/octoscan/HEAD/img/AcalaNetwork.png -------------------------------------------------------------------------------- /img/alibaba.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/synacktiv/octoscan/HEAD/img/alibaba.png -------------------------------------------------------------------------------- /img/ant-design.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/synacktiv/octoscan/HEAD/img/ant-design.png -------------------------------------------------------------------------------- /img/autogpt.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/synacktiv/octoscan/HEAD/img/autogpt.png -------------------------------------------------------------------------------- /img/dependabot.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/synacktiv/octoscan/HEAD/img/dependabot.png -------------------------------------------------------------------------------- /img/excalidraw.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/synacktiv/octoscan/HEAD/img/excalidraw.png -------------------------------------------------------------------------------- /img/haskell.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/synacktiv/octoscan/HEAD/img/haskell.png -------------------------------------------------------------------------------- /img/swagger.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/synacktiv/octoscan/HEAD/img/swagger.png -------------------------------------------------------------------------------- /img/test.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/synacktiv/octoscan/HEAD/img/test.png -------------------------------------------------------------------------------- /octoscan.go: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/synacktiv/octoscan/HEAD/octoscan.go --------------------------------------------------------------------------------