SquidGate

A SquidSec Open Source Project
SquidOffense.com · GitHub

SquidGate is an open source LLM-powered PR security gate for GitHub, created and managed by SquidSec. It analyzes pull request diffs, posts annotated findings, and fails the check when issues cross your severity threshold — so you can block merges with standard branch protection.

Organization	SquidSec
Website	https://squidoffense.com/
App version	v1.0.0
Latest release
Pin in workflows	SquidSec/SquidGate@v1
License	MIT
Runtime	Node 20 (bundled action)

Merges to main automatically run tests, rebuild the action bundle, and publish a GitHub Release (tag v1.0.0-build.N). The floating tags v1 and v1.0 always point at the latest successful build for that line.

---

About SquidSec

SquidGate is built and maintained by SquidSec for the security community — appsec engineers, platform teams, and developers who want a merge-blocking PR gate without standing up a full SAST platform.

• Website: https://squidoffense.com/
• Project: https://github.com/SquidSec/SquidGate

---

60-second setup

1. Add the workflow

Create .github/workflows/squidgate.yml:

name: SquidGate

on:
  pull_request:
    types: [opened, synchronize, reopened]

permissions:
  contents: read
  pull-requests: write
  checks: write

jobs:
  squidgate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: SquidGate
        uses: SquidSec/SquidGate@v1
        with:
          llm-api-key: ${{ secrets.LLM_API_KEY }}

2. Add your LLM API key

Settings → Secrets and variables → Actions → New repository secret

Name	Value
LLM_API_KEY	Your provider key (OpenAI, xAI, Anthropic, …)

3. Block merges when SquidGate finds issues

Settings → Rules → Rulesets (or Branches → Branch protection) on main:

• Require a pull request before merging
• Require status checks to pass:
  • squidgate (workflow job)
  • SquidGate (check run)

When SquidGate reports findings at or above block_on, both checks fail and GitHub blocks merge.

Open a PR. Done.

---

Try it on your language

20 open sample PRs — one per major language — each with intentional findings:

Browse language sample PRs →

JavaScript	TypeScript	Python	Java
C#	Go	Rust	C++
C	PHP	Ruby	Swift
Kotlin	Scala	Shell	Dart
PowerShell	SQL	Perl	Lua

---

Using Grok (xAI)

- uses: SquidSec/SquidGate@v1
  with:
    llm-api-key: ${{ secrets.LLM_API_KEY }}
    llm-provider: custom
    llm-model: grok-build-0.1
    llm-base-url: https://api.x.ai/v1

Key: console.x.ai

---

Why SquidGate?

	Traditional SAST	SquidGate
Languages	Per-language rules	Any text-based source
Setup	Days of tuning	~2 minutes
Context	Whole-repo noise	Diff-first + context
Model	Fixed engine	Your LLM
Merge gate	Separate tooling	Native GitHub Check
Privacy	Vendor by default	Only your endpoint

---

Configuration (optional)

Defaults are production-ready. Override with .github/squidgate.yml:

version: 1

llm:
  provider: openai
  model: gpt-4o

policy:
  block_on: high            # critical | high | medium | low | none
  min_confidence: medium
  categories:
    secrets: true
    injection: true
  custom_rules: []

context:
  lines_before: 30
  max_files: 50
  max_diff_bytes: 500000

output:
  comment_on_pr: true
  annotate_lines: true
  fail_on_error: true

Full reference: docs/configuration.md · Example: .github/squidgate.yml.example

---

What it detects

• Hardcoded secrets / API keys / private keys
• SQL / command / XSS / SSRF / path traversal
• Insecure deserialization
• Broken authn / authz patterns
• Weak crypto · dangerous APIs (eval, exec, pickle, …)
• Patterns aligned with OWASP Top 10, API Security Top 10, CWE Top 25

---

Versions & tags

Tag	Meaning	Use when
v1	Latest stable major (floating)	Recommended for most repos
v1.0	Latest 1.0.x line (floating)	Minor pin
v1.0.0	Exact semver release	Rare; prefer build tags below
v1.0.0-build.N	Immutable CI build from main	Audit / pin to a known build

# Recommended
uses: SquidSec/SquidGate@v1

# Pin to an immutable build
uses: SquidSec/SquidGate@v1.0.0-build.12

# Or full commit SHA
uses: SquidSec/SquidGate@abc123def

All releases: https://github.com/SquidSec/SquidGate/releases
Latest: https://github.com/SquidSec/SquidGate/releases/latest

---

Action inputs

Input	Required	Default	Description
llm-api-key	Yes	—	Provider API key
github-token	No	${{ github.token }}	checks + pull-requests + contents
config-path	No	.github/squidgate.yml	Config path
llm-provider	No	config / openai	openai | anthropic | azure | google | custom
llm-model	No	config / gpt-4o	Model id
llm-base-url	No	—	Azure / custom / xAI URL
block-on	No	config / high	Minimum failing severity

Outputs

Output	Description
findings-count	Findings after confidence filter
blocking-findings-count	Findings ≥ block_on
conclusion	success | failure

---

Privacy

• Diffs go only to the LLM endpoint you configure
• SquidSec does not receive or store your code
• Least-privilege permissions; self-hosted runners + private models supported

→ docs/privacy.md

---

How it works

PR opened / updated
        │
        ▼
  Unified diff (+ context)
        │
        ▼
  Policy-aware prompts (temperature 0, JSON)
        │
        ▼
  Your LLM
        │
        ▼
  Filter → annotate → PR comment
        │
        ▼
  Fail check if finding ≥ block_on

---

Development

git clone https://github.com/SquidSec/SquidGate.git
cd SquidGate
npm ci
npm test
npm run build

See docs/development.md · CONTRIBUTING.md

---

License

MIT © SquidSec