A GitHub Action that analyses your java source code for all versions of the log4j vulnerability that affect both log4j 1.x and 2.x. You can read more about all versions of Log4j that are affected here: https://logging.apache.org/log4j/2.x/security.html

name: Example Workflow Using the SecureStack log4j scanning Action
on: push
jobs:
  security:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repo for running log4j analysis
        id: checkout
        uses: actions/[email protected]
        with:
          fetch-depth: 0
      - name: Log4j Scanning Step
        id: log4j
        uses: SecureStackCo/[email protected]
        with:
          securestack_api_key: ${{ secrets.SECURESTACK_API_KEY }}
          securestack_app_id: ${{ secrets.SECURESTACK_APP_ID }}
          severity: critical

1. Create a SecureStack account using your GitHub credentials. You get 20 scans for free and you don't need to add a credit card.
2. Once you are logged in go to "Profile" in the black drawer on the left, and then -> GENERATE KEY tab.
3. Generate an API key and copy the value.
4. Go to Settings for your GitHub repository and click on Secrets -> Actions at the bottom left.
5. Create a new secret named SECURESTACK_API_KEY and paste the value from step 2 into the field.

1. Log in to SecureStack.
2. Open the application you wish to analyse. If you haven't created a managed application you can follow the directions in this VIDEO to create one.
3. Copy the value of the application id on the View Application screen.
4. Go to Settings for your GitHub repository and click on Secrets -> Actions at the bottom left.
5. Create a new secret named SECURESTACK_APP_ID and paste the value from step 3 into the field.

1. SecureStack Secrets Analysis - Scan your application for embedded api keys, credentials and senstive data.
2. SecureStack Software Composition Analysis (SCA) - Scan your application for vulnerable third-party and open source libraries.
3. SecureStack Web Vulnerability & Cloud Misconfiguration Analysis - Scan your running application url for cloud misconfigurations and web vulnerabilities.

https://www.youtube.com/watch?v=YrPITQNy9UM&list=PL_8Xjyi5rInxzhpQkDRipipmaj0lT6pJ8

Made with 💜 by SecureStack