Integration · DevSecOps
HailBytes + GitHub
A published Marketplace Action, findings as issues, and monitoring for the secrets that leak into public commits.
Three integrations
- GitHub Action (Marketplace). A two-mode action: trigger a scan and fetch SARIF for GitHub Code Scanning, or POST an asset list to the inbound asset webhook. Dockerised on a ~50 MB Alpine image so cold starts stay fast on hosted runners.
- Issue creation. Triaged findings open issues against any repository — including private and GitHub Enterprise Server — with
severity:*labels applied automatically and idempotent updates on rediscovery. - Commit-stream secret monitoring. Keyword-filtered polling of the public events API every five minutes, with TruffleHog confirmation before anything is raised. Confirmed leaks become Critical-severity findings with the commit as evidence.
That third one is the part teams tend not to expect: secrets pushed to a public repository are an external exposure like any other, and they're usually found by someone else first. Catching them in the five-minute window is a materially different outcome from catching them in the next quarterly review.
Bring your own PAT or GitHub App credentials. Action minutes and seats stay on your existing GitHub plan.