🛡️ GitHub Public Organization Security & Dependency Health Auditor

Conduct automated outside-in cybersecurity risk assessments and open-source software supply chain audits across public GitHub organizations.

Discover unpatched CVE and GHSA vulnerabilities, outdated dependency technical debt, and restrictive copyleft license contamination risks across public repositories — with zero API keys or tokens required.

---

🌟 Why Use This Auditor?

B2B cybersecurity intelligence firms, venture capital technical due-diligence teams, corporate IT risk departments, and software supply chain auditors constantly monitor organizations to assess their digital attack surface.

Traditional Scanners	🛡️ GitHub Security & Dependency Health Auditor
❌ Requires admin GitHub OAuth access to every repo	✅ 100% tokenless outside-in scanning of public repositories
❌ Requires heavy local CLI installations & agents	✅ Cloud-native execution via Apify with automated scheduling
❌ Proprietary closed vulnerability databases	✅ Official Google OSV API matching CVE & GitHub Security Advisories
❌ Messy unstructured logs or bloated JSON blobs	✅ Pristine tabular dataset ready for CSV, Excel, BigQuery, or BI
❌ Misses license contamination	✅ Flags copyleft licenses (GPL/AGPL/SSPL) in commercial codebases

---

🚀 Key Capabilities

• 🔍 Multi-Ecosystem Manifest Inspection: Parses package.json (npm / JavaScript & TypeScript), requirements.txt / pyproject.toml (PyPI / Python), go.mod (Go), Cargo.toml (Rust), and pom.xml (Maven / Java).
• ⚠️ Real-Time CVE & GHSA Advisory Matching: Queries the open Google OSV API to identify known security vulnerabilities with CVSS scores, vulnerability descriptions, and recommended upstream fix versions.
• 📦 Registry Release & Outdated Debt Tracking: Checks official upstream registries via Google deps.dev to calculate version delta and flag stale dependencies.
• ⚖️ Intellectual Property & License Risk Detection: Detects restrictive copyleft licenses (e.g. GPL-2.0, GPL-3.0, AGPL-3.0, SSPL) that may introduce legal contamination risks for commercial applications.
• 📊 Executive Cyber Health Scorecard: Automatically computes an organizational Cyber Health Grade (A through F) and saves an aggregated scorecard to the default Key-Value Store (OUTPUT and SUMMARY).
• 🔔 Discord & Slack Webhook Notifications: Instantly alerts security teams when CRITICAL or HIGH severity CVEs are identified.

---

📥 Input Parameters

Parameter	Type	Default	Description
orgName	String	"expressjs"	The GitHub organization handle to audit (e.g. pallets, expressjs, facebook).
maxRepos	Integer	15	Maximum number of public repositories to discover and scan (1–200).
scanEcosystems	Array	["npm", "pypi", "golang", "cargo"]	Package ecosystems to inspect (npm, pypi, golang, cargo, maven).
minSeverity	String	"ALL"	Minimum severity threshold (ALL, LOW, MEDIUM, HIGH, CRITICAL).
checkLicenses	Boolean	true	Flags copyleft licenses (GPL, AGPL, SSPL) posing compliance risks.
includeSummaryInDataset	Boolean	false	When false (Recommended), dataset contains 100% clean finding rows, and the executive scorecard is stored in Key-Value Store.
githubToken	String (Secret)	null	Optional GitHub Personal Access Token to raise API rate limits for high-volume enterprise scans.
webhookUrl	String	null	Optional Discord or Slack webhook URL for real-time threat notifications.

Example Input

{
  "orgName": "expressjs",
  "maxRepos": 15,
  "scanEcosystems": ["npm"],
  "minSeverity": "ALL",
  "checkLicenses": true,
  "includeSummaryInDataset": false
}

---

📤 Output Structure

1. Tabular Dataset (items)

Every dataset row represents an audited dependency finding with consistent columns, ideal for immediate export to CSV, Excel, or Google Sheets:

{
  "isSummaryCard": false,
  "orgName": "expressjs",
  "repoName": "express",
  "repoUrl": "https://github.com/expressjs/express",
  "manifestPath": "package.json",
  "manifestUrl": "https://github.com/expressjs/express/blob/master/package.json",
  "ecosystem": "npm",
  "packageName": "qs",
  "installedVersion": "6.13.0",
  "latestVersion": "6.14.0",
  "isOutdated": true,
  "hasVulnerability": false,
  "severity": "CLEAN",
  "cvssScore": 0.0,
  "vulnerabilityIds": null,
  "advisorySummary": null,
  "fixVersion": null,
  "license": "BSD-3-Clause",
  "isCopyleftRisk": false,
  "discoveredAt": "2026-09-23T14:30:00.000Z"
}

2. Executive Scorecard (OUTPUT & SUMMARY in Key-Value Store)

Access high-level organizational posture without polluting CSV/Excel rows:

{
  "isSummaryCard": true,
  "orgName": "expressjs",
  "securityGrade": "B",
  "discoveredAt": "2026-09-23T14:30:00.000Z",
  "totalReposAudited": 15,
  "reposWithVulnerabilities": 1,
  "totalDependenciesAudited": 42,
  "totalVulnerabilities": 2,
  "criticalCount": 0,
  "highCount": 0,
  "mediumCount": 2,
  "lowCount": 0,
  "outdatedDependenciesCount": 9,
  "copyleftLicensesCount": 0,
  "topThreatRepositories": [
    {
      "repoName": "express",
      "critical": 0,
      "high": 0,
      "medium": 2,
      "low": 0,
      "total": 2
    }
  ]
}

---

🛡️ Responsible Disclosure & Legal Notice

This Actor queries only publicly accessible open-source codebases and public vulnerability registries (Google OSV, deps.dev). It performs zero active penetration testing, exploitation, or payload delivery. All data retrieved consists of public software dependencies and known vulnerability disclosures.