repo-risk-radar

repo-risk-radar is a practical security risk scanner for open-source maintainers. It looks for high-signal issues that often create maintainer load: risky GitHub Actions patterns, possible committed secrets, missing security policies, and weak release or contributor hygiene.

The goal is not to replace a full security audit. The goal is to give maintainers a quick, readable first pass before reviewing a pull request, preparing a release, or tightening a repository.

Install

python -m pip install repo-risk-radar

For local development:

python -m pip install -e ".[dev]"

Usage

Scan a repository:

repo-risk-radar scan .

Emit JSON for automation:

repo-risk-radar scan . --format json

List available rules:

repo-risk-radar rules

What It Checks

• GitHub Actions workflows with missing or broad permissions.
• pull_request_target usage that deserves careful review.
• GitHub Actions references that are not pinned to a commit SHA.
• Workflow steps that pipe remote downloads into shell interpreters.
• Possible private keys, cloud access keys, or long token-like assignments.
• Missing SECURITY.md, LICENSE, changelog, issue templates, or contributing guide.

Example JSON

{
  "findings": [
    {
      "line": 8,
      "message": "Action reference 'actions/checkout@v4' is mutable or missing a commit SHA.",
      "path": ".github/workflows/ci.yml",
      "recommendation": "Pin third-party actions to a reviewed 40-character commit SHA.",
      "rule_id": "GHA004",
      "severity": "medium",
      "title": "Action reference is not pinned to a commit SHA"
    }
  ],
  "path": "/path/to/repo",
  "summary": {
    "medium": 1
  }
}

Project Status

This project is new and intentionally modest. It is meant to become useful through focused rules, maintainer feedback, tests, and clear remediation guidance.

Contributing

See CONTRIBUTING.md for setup and contribution guidelines.

Security

See SECURITY.md for vulnerability reporting.

License

MIT. See LICENSE.