GitHub Action

The official SecretsBuster Scan Action wraps the API so you can scan deployed URLs on every push or pull request without writing any polling logic yourself, and fail the build automatically when secrets are found.

Setup

1. Get an API key

Subscribe to a plan and retrieve your API key if you haven't already.

2. Add it as a repository secret

In your repository, go to Settings → Secrets and variables → Actions and add your API key as a new secret named SB_API_KEY.

3. Add a workflow

Create .github/workflows/secretsbuster.yml:

name: SecretsBuster Scan

on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - name: Run SecretsBuster scanner
        uses: rank0-dev/secretsbuster-scan-action@v1
        with:
          sb-api-key: ${{ secrets.SB_API_KEY }}
          targets: |
            https://example.com
            https://staging.example.com

Trigger the workflow (push or open a PR) and the action will scan every listed target.

Inputs

Input	Description	Required
sb-api-key	Your SecretsBuster API key	Yes
targets	URLs to scan, one per line (| block)	Yes

Invalid target URLs are logged as warnings and recorded with an ERROR result rather than failing the step outright.

Outputs

Output	Description
scan-results	JSON array of scan results, one per target

Each entry looks like:

[
  {
    "url": "https://example.com",
    "scanResult": "SAFE",
    "reportPublicId": "432fa629-899a-42ed-9714-cb9878ec2ae7"
  },
  {
    "url": "https://leaky-example.com",
    "scanResult": "LEAKY",
    "reportPublicId": "b130c67f-8c2b-4c66-97a6-78e5d20b5a3b"
  }
]

• SAFE — no secrets detected.
• LEAKY — secrets were found. The action fails the workflow.
• ERROR — the scan failed or the target was invalid. The action fails the workflow.

Use reportPublicId with the REST API (GET /reports/{publicId}) to pull the full report, including which document leaked what.

Access the output in a later step with:

${{ steps.<step-id>.outputs.scan-results }}

How it works

• The action submits a scan request per target and polls every 15 seconds until each reaches CRAWLED or ERROR.
• It fails the job if any target comes back LEAKY or ERROR, blocking the workflow (e.g. a deploy) from proceeding with exposed credentials still live.
• Full progress is logged to the workflow console as it runs.

Advanced: scheduled scans and downstream steps

Because the action just wraps the API, you can trigger it on a schedule instead of (or in addition to) push/PR events, and use its output in later steps — e.g. to post to Slack on failure:

name: SecretsBuster with Notifications

on:
  schedule:
    - cron: '0 6 * * *'  # Daily at 6 AM

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - name: Scan production sites
        id: secretsbuster
        uses: rank0-dev/secretsbuster-scan-action@v1
        with:
          sb-api-key: ${{ secrets.SB_API_KEY }}
          targets: |
            https://www.mysite.com
            https://api.mysite.com
            https://app.mysite.com

      - name: Process results
        if: always()
        run: |
          echo "Scan results:"
          echo '${{ steps.secretsbuster.outputs.scan-results }}' | jq .

      - name: Notify on failure
        if: failure()
        run: |
          # Send alert to Slack, PagerDuty, etc.
          echo "Secrets detected! Check the scan results."

Targets scanned this way are also recorded on your SecretsBuster account, so you'll see them in the dashboard alongside anything scanned manually or via the API.