Public AppSec tooling from Gemini's security engineering team, adapted for use in open source projects.
This repository contains security workflows, scanners, and automation tools for securing Gemini's open source projects.
Runs Semgrep static analysis on pull requests and on a weekly schedule. Uses community rulesets (p/default, p/security-audit, p/owasp-top-ten) with no Semgrep account or token required. Findings are uploaded to GitHub Code Scanning.
.github/workflows/scan-for-secrets.yml
Scans pull requests for verified secrets using TruffleHog. Only reports verified findings to minimize noise. No token or license required.
This repository is maintained by Gemini's AppSec team. External contributions and feedback are welcome via GitHub Issues.
See LICENSE for details.