v1.0.0

Hack yourself before they do.

One-command website security check for people who have never run a security tool. Add it to your workflow and every push gets scanned, with findings landing in your repo's Security tab.

What it checks

14 checks in one run: SQL injection (error-based and boolean-based), exposed files, reflected XSS, open redirects, CORS, debug traces, login rate limiting, security headers, cookie flags, TLS/HTTPS, version disclosure, dangerous HTTP methods, plus robots.txt and security.txt posture.

Before probing, the built-in mini-crawler maps your app like a visitor would, so every check hits a real page or form. No blind fuzzing of made-up paths.

Plain-English findings

Every finding ships with what it means (one sentence, no jargon) and how to fix it (one sentence, actionable), plus a 0-100 score and an A-F grade.

Usage

- uses: Shifu34/hackable@v1
  with:
    target: https://your-site.com
    fail-under: 70

Inputs

Input	Required	Default	Description
target	yes		URL of the app to scan
fail-under	no	70	Fail the workflow if the score is below this
sarif	no	true	Upload results to GitHub code scanning

Safety

Only scan apps you own or have explicit permission to test. Probes are harmless and non-destructive, but unauthorized scanning may be illegal.