Add one workflow file. Every pull request gets scanned. Critical findings block the merge. Your team ships with confidence.
- uses: flowpatrol/scan-action@v1
with:
target-url: https://staging.myapp.com
api-key: ${{ secrets.FLOWPATROL_API_KEY }}Four lines. That's all it takes.
Developer pushes code. Your preview deploy goes live on Vercel, Netlify, or Railway.
Flowpatrol tests the live preview URL for real vulnerabilities. Auth flows, access control, exposed data.
Findings posted as a PR comment with severity, evidence, and fixes. SARIF uploaded to Code Scanning.
GET /api/users/42Every finding includes the endpoint, evidence, CWE code, and a concrete fix.
Set fail-on: high and PRs with high or critical findings get blocked. Your team decides the threshold.
Findings show up in GitHub's Security tab alongside CodeQL and Dependabot. One place for everything.
Updates the existing PR comment on each push instead of posting a new one. No noise, always current.
quick scans headers only. standard runs the full test. deep goes aggressive with chained attacks.
Checks your balance before scanning. Clear error message if credits are low. No surprise failures.
Default 15 minutes. Bump it up for deep scans on larger apps. The action waits and streams progress.
name: Security Scan
on:
pull_request:
types: [opened, synchronize]
jobs:
scan:
runs-on: ubuntu-latest
steps:
- name: Flowpatrol Security Scan
uses: flowpatrol/scan-action@v1
with:
# Required
target-url: ${{ env.PREVIEW_URL }}
api-key: ${{ secrets.FLOWPATROL_API_KEY }}
# Scan mode: quick | standard | deep
mode: standard
# Block the PR if findings meet this severity
# Options: critical | high | medium | low | none
fail-on: high
# Post findings as a PR comment (default: true)
comment: true
# Upload SARIF to GitHub Code Scanning (default: true)
sarif: true
# Max scan duration in minutes (default: 15)
timeout: 15Most teams only need target-url and api-key. Everything else has sensible defaults.
| Output | Type | Description |
|---|---|---|
scan-id | string | Unique scan identifier for the Flowpatrol dashboard |
status | string | Scan result: passed, failed, or error |
critical-count | number | Number of critical findings |
high-count | number | Number of high findings |
medium-count | number | Number of medium findings |
low-count | number | Number of low findings |
report-url | string | Direct link to the full report on Flowpatrol |
- name: Flowpatrol Scan
id: scan
uses: flowpatrol/scan-action@v1
with:
target-url: ${{ env.PREVIEW_URL }}
api-key: ${{ secrets.FLOWPATROL_API_KEY }}
- name: Post to Slack on failure
if: steps.scan.outputs.status == 'failed'
run: |
curl -X POST ${{ secrets.SLACK_WEBHOOK }} \
-d '{"text": "Security scan failed: ${{ steps.scan.outputs.critical-count }} critical, ${{ steps.scan.outputs.high-count }} high. ${{ steps.scan.outputs.report-url }}"}'One workflow file. Every PR scanned. Your team ships faster because they ship with confidence.
- uses: flowpatrol/scan-action@v1
with:
target-url: https://staging.myapp.com
api-key: ${{ secrets.FLOWPATROL_API_KEY }}