mirror of
https://github.com/profullstack/logicsrc.git
synced 2026-08-13 14:37:26 +00:00
Anthony Ettinger
bfb536c894
vu1nz reviews a diff by calling Claude, which needs ANTHROPIC_API_KEY supplied through the ENV_FILE secret. That key is not present on this repository, so the scanner has never reviewed a pull request. On pack 1.0.0 and 1.0.1 that failure was silent: the job reported "0 finding(s), no high/critical issues" on a diff nothing had read, which is worse than no scanner at all. threatcrush-scan covers the same ground deterministically - credentials, injection, SSRF, unsafe deserialisation, XXE, dependency tampering - with no API key and no per-pull-request cost. Reinstallable from the sh1pt Actions Store if the key is ever provisioned. Co-authored-by: Claude Opus 5 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| ci.yml | ||
| test.yml | ||
| threatcrush-scan.yml | ||