polyscan.GitHub
✳ BUILT FOR THE OPEN SOURCE COMMUNITY

Different stacks.
One security check.

Your code speaks many languages. Your security workflow shouldn't have to. Bring your scanners together with one free GitHub Action.

Build your workflow Read the docs
MIT licensedNo account requiredRuns in your CI
your-repo / security⌘
POLYSCAN / WORKFLOW PREVIEWv17.3.0
✳
One action. Full picture.

Source → scanners → unified reports

TSJavaScript / TypeScriptoxlint✓
PyPythonBandit✓
GoGogosec✓
Dependencies & IaCTrivy✓
✓ Quality gate passed0 critical · 0 high
polyscan.sarifpolyscan.sbom.jsonJob summaryPR comments

Illustrative workflow · results depend on your repository

LESS GLUE CODE. MORE CONFIDENCE.14 engines1 normalized schemaYour quality gate100% open source
01 / COVER YOUR STACK

A whole toolkit.
A single entry point.

From Python to pull requests, choose the engines your project needs. Or use all and let language-specific engines skip files that aren't there.

INCLUDED

Semgrep

Multi-language

Source code
OPT-IN

OpenGrep

Multi-language

Source code · opt-in
INCLUDED

Bandit

Python

Source code
INCLUDED

oxlint

JavaScript / TypeScript

Source code
OPT-IN

ESLint

JavaScript

Source code · opt-in
INCLUDED

SpotBugs

Java / Kotlin

Bytecode analysis
INCLUDED

detekt

Kotlin

Source code
INCLUDED

gosec

Go

Source code
INCLUDED

Trivy

Dependencies / IaC

CVEs & misconfiguration
INCLUDED

Gitleaks

Git history / files

Secret detection
INCLUDED

betterleaks

Working tree

Secret detection
INCLUDED

Hadolint

Dockerfiles

Container best practices
INCLUDED

zizmor

GitHub Actions

Workflow security
OPT-IN

TruffleHog

Files / credentials

Live verification · opt-in

“all” includes 11 engines. OpenGrep, ESLint and TruffleHog are explicit opt-ins. PolyScan supports Linux x64 runners.

02 / FROM FINDINGS TO ACTION

Less noise.
Clearer decisions.

Different scanners, consistent results. Keep the useful detail and make your merge rules explicit.

01

A gate you control

Set thresholds for critical, high and medium findings. Fail the job when your limit is exceeded.

02

Reports that fit your workflow

Unified SARIF, an optional CycloneDX SBOM and a job summary with severity and engine charts, hotspot files, top rules and findings linked to their source lines. Upload SARIF to Code Scanning with the documented CodeQL step.

03

Your runner. Your repository.

A native TypeScript action on Node 24. Pinned scanner versions, verified binary downloads and bounded concurrency.

04

Findings where you review

Turn on reviewdog to get comments on the lines a pull request adds or changes, plus a neutral check that marks every finding in the diff. Your gate still decides the merge.

03 / MAKE IT YOURS

Your stack.
Your workflow.

Pick a starting point, adjust the reports and copy a ready-to-use workflow into .github/workflows/polyscan.yml.

CHOOSE YOUR STACK

Free MIT-licensed action. GitHub runner usage and Code Scanning availability follow GitHub's own policies.

polyscan.yml
YAMLubuntu-latest · polyscan-action@v17.3.0
TRY THE QUALITY GATE

Where do you draw the line?

Adjust the allowed high-severity findings to see how the gate responds.

Simulation · 0 critical, 3 high, 12 medium findings
Strict · 06 · Tolerant
× Quality gate failed3 high findings exceed your limit of 0.
04 / OPEN BY DEFAULT

Good security should
be everyone's business.

Free to use. Free to inspect. Free to improve.
PolyScan is MIT licensed and built for the people building in the open.

Explore on GitHub Report an issue
MITOpen-source license
$0PolyScan license cost
YoursWorkflow & thresholds
A FEW GOOD QUESTIONS

Before your first scan.

Is PolyScan really free?

Yes. PolyScan is released under the MIT license. There is no PolyScan subscription or account. GitHub Actions runner usage and the underlying scanners' licenses still apply.

Does it work with private repositories?

The action can run in private repositories on supported Linux x64 runners. GitHub Code Scanning availability depends on your repository and GitHub plan; local reports and workflow artifacts don't require that integration.

Does every engine run on every project?

Language-specific engines check for relevant files and skip when those files are absent. The “all” preset includes eleven engines; OpenGrep, ESLint and TruffleHog must be enabled explicitly.

What should I know about scans?

SpotBugs may invoke your Maven or Gradle build. TruffleHog is opt-in because it verifies discovered credentials against provider APIs. OpenGrep's automatic configuration may need network access; local rules offer an offline-friendly alternative. Review the README for each engine's behavior.

How do I contribute?

Start with the repository README, report a reproducible issue or open a pull request. The source, tests and scanner version lock file are all available on GitHub.