Adding XploitScan under Tools, with the other pipeline scanners.
- [XploitScan](https://xploitscan.com) - SAST scanner for JavaScript, TypeScript,
and Node.js codebases that runs as a GitHub Action with SARIF output, surfacing
212 rules worth of findings (secrets, injection, XSS, SSRF, prototype pollution,
crypto misuse) directly in GitHub's code scanning tab. Also available as a CLI
and VSCode extension.
Disclosure: I build this. Happy to adjust the wording or drop it if it's not a fit for the list's scope.
The CI/CD angle is the GitHub Action: it runs on PRs and writes SARIF, so findings land in GitHub's code scanning tab rather than only in logs.
Scope, stated honestly: regex + AST with light taint analysis for JS/TS/Python and config files, not CodeQL-grade interprocedural analysis. The detection benchmark is public and reproducible at https://xploitscan.com/benchmark, including the cases it misses.
This supersedes #22, which I closed prematurely while it was still awaiting review. Rebased on current main — the earlier one carried an unrelated whitespace change to the releaserun line, which is gone. Single-line addition, CRLF preserved, and the rule count is corrected (158 → 212).
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.
## 📋 Pull Request Information
**Original PR:** https://github.com/myugan/awesome-cicd-security/pull/34
**Author:** [@bgage72590](https://github.com/bgage72590)
**Created:** 8/21/2026
**Status:** 🔄 Open
**Base:** `main` ← **Head:** `add-xploitscan`
---
### 📝 Commits (1)
- [`7f37d64`](https://github.com/myugan/awesome-cicd-security/commit/7f37d646b945d297534aa3795eadcc9892a68e4d) Add XploitScan to Tools
### 📊 Changes
**1 file changed** (+1 additions, -0 deletions)
<details>
<summary>View changed files</summary>
📝 `README.md` (+1 -0)
</details>
### 📄 Description
Adding XploitScan under **Tools**, with the other pipeline scanners.
```
- [XploitScan](https://xploitscan.com) - SAST scanner for JavaScript, TypeScript,
and Node.js codebases that runs as a GitHub Action with SARIF output, surfacing
212 rules worth of findings (secrets, injection, XSS, SSRF, prototype pollution,
crypto misuse) directly in GitHub's code scanning tab. Also available as a CLI
and VSCode extension.
```
**Disclosure: I build this.** Happy to adjust the wording or drop it if it's not a fit for the list's scope.
The CI/CD angle is the GitHub Action: it runs on PRs and writes SARIF, so findings land in GitHub's code scanning tab rather than only in logs.
Scope, stated honestly: regex + AST with light taint analysis for JS/TS/Python and config files, not CodeQL-grade interprocedural analysis. The detection benchmark is public and reproducible at https://xploitscan.com/benchmark, including the cases it misses.
This supersedes #22, which I closed prematurely while it was still awaiting review. Rebased on current `main` — the earlier one carried an unrelated whitespace change to the `releaserun` line, which is gone. Single-line addition, CRLF preserved, and the rule count is corrected (158 → 212).
---
<sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
📋 Pull Request Information
Original PR: https://github.com/myugan/awesome-cicd-security/pull/34
Author: @bgage72590
Created: 8/21/2026
Status: 🔄 Open
Base:
main← Head:add-xploitscan📝 Commits (1)
7f37d64Add XploitScan to Tools📊 Changes
1 file changed (+1 additions, -0 deletions)
View changed files
📝
README.md(+1 -0)📄 Description
Adding XploitScan under Tools, with the other pipeline scanners.
Disclosure: I build this. Happy to adjust the wording or drop it if it's not a fit for the list's scope.
The CI/CD angle is the GitHub Action: it runs on PRs and writes SARIF, so findings land in GitHub's code scanning tab rather than only in logs.
Scope, stated honestly: regex + AST with light taint analysis for JS/TS/Python and config files, not CodeQL-grade interprocedural analysis. The detection benchmark is public and reproducible at https://xploitscan.com/benchmark, including the cases it misses.
This supersedes #22, which I closed prematurely while it was still awaiting review. Rebased on current
main— the earlier one carried an unrelated whitespace change to thereleaserunline, which is gone. Single-line addition, CRLF preserved, and the rule count is corrected (158 → 212).🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.