If you discover a security vulnerability, please report it via GitHub's private vulnerability reporting. Do not open a public issue.

You should receive an acknowledgment within 48 hours.

This repo contains a GitHub Action wrapper — a composite action that installs and runs ActionSieve. For vulnerabilities in the scanner itself, report to the main repo.

Security-relevant areas in this action:

• Input handling — all inputs are passed via environment variables, never interpolated directly into shell commands
• Action pinning — all uses: references are pinned to SHA
• SARIF upload — results go only to the calling repo's Code Scanning