Promptfoo Code Scanning / GitHub Action
GitHub Action scanner for LLM-specific app vulnerabilities like prompt injection.
Promptfoo Code Scanning / GitHub Action
GitHub Action scanner for LLM-specific app vulnerabilities like prompt injection.
Data verified May 2026
ADYour product here. Reach security decision-makers.Launch a campaignPromptfoo Code Scanning / GitHub Action Description
LLM Security
Prompt Injection
GenAI Security
Agentic AI Security
DEVSECOPS
CI/CD
Scanner
Security Scanning
PII
Data Exfiltration
Promptfoo Code Scanning is a GitHub Action-based security scanner designed to detect vulnerabilities specific to applications built on large language models (LLMs) and AI agents. It integrates into the pull request (PR) review workflow and performs agentic code tracing to identify security issues before they reach production. The scanner focuses on LLM-specific vulnerability classes, including: - Prompt Injection: untrusted input reaching LLM prompts without sanitization - Data Exfiltration: indirect prompt injection vectors that could extract data through agent tools - PII Exposure: code that may leak sensitive user data to LLMs or log confidential information - Improper Output Handling: LLM outputs used in dangerous contexts such as SQL queries or shell commands - Excessive Agency: LLMs with overly broad tool access or missing approval gates - Jailbreak Risks: weak system prompts or guardrail bypasses that could allow harmful outputs Key operational characteristics: - Deep tracing: the scanner goes beyond the PR diff, tracing LLM inputs, outputs, and capability changes throughout the broader repository - Low false-positive design: maintains a high reporting bar to reduce alert fatigue; maintainers can configure severity levels and provide custom instructions - Fix suggestions: each finding includes a suggested remediation and a prompt that can be passed to an AI coding agent for further investigation and resolution The tool has been tested against real CVEs in LangChain, Vanna.AI, and LlamaIndex. No account, credit card, or API keys are required to get started.
Promptfoo Code Scanning / GitHub Action FAQ
Common questions about Promptfoo Code Scanning / GitHub Action including features, pricing, alternatives, and user reviews.
Promptfoo Code Scanning / GitHub Action is GitHub Action scanner for LLM-specific app vulnerabilities like prompt injection, developed by Promptfoo. It is a AI Security solution designed to help security teams with LLM Security, Prompt Injection, GenAI Security.
Promptfoo Code Scanning / GitHub Action offers the following core capabilities:
1.Detection of prompt injection vulnerabilities in LLM applications
2.Identification of data exfiltration vectors via indirect prompt injection
3.PII exposure detection in LLM inputs and logs
4.Detection of improper LLM output handling (e.g., in SQL or shell contexts)
5.Excessive agency detection for overly broad LLM tool access
6.Jailbreak risk detection from weak system prompts or guardrail bypasses
7.Deep agentic tracing of LLM inputs, outputs, and capability changes across the repository
8.Configurable severity levels and custom scanning instructions
9.Per-finding remediation suggestions with AI-agent-compatible fix prompts
Promptfoo Code Scanning / GitHub Action integrates natively with GitHub, GitHub Actions. Integration support lets security teams connect Promptfoo Code Scanning / GitHub Action to existing SIEM, ticketing, identity, and notification systems without custom development.
Promptfoo Code Scanning / GitHub Action is built for security teams handling LLM Security, Prompt Injection, GenAI Security, Agentic AI Security. It supports workflows including detection of prompt injection vulnerabilities in llm applications, identification of data exfiltration vectors via indirect prompt injection, pii exposure detection in llm inputs and logs. Teams typically adopt Promptfoo Code Scanning / GitHub Action when they need to ai security capabilities integrated into their existing stack. Explore similar tools at https://cybersectools.com/alternatives/promptfoo-code-scanning-github-action
Promptfoo Code Scanning / GitHub Action is a free AI Security tool. This makes it accessible for organizations of all sizes, from startups to enterprises. Visit https://www.promptfoo.dev/code-scanning/github-action/ for download and installation instructions.
Popular alternatives to Promptfoo Code Scanning / GitHub Action include:
1.Prompt Security GenAI Solutions - GenAI security platform for shadow AI discovery, prompt injection defense & DLP (Commercial)
2.Opsin - AI security platform to discover, govern & monitor AI data exposure risks. (Commercial)
3.Witness AI for Developers - Security platform for AI coding assistants and development agents (Commercial)
4.Zscaler SPLX - End-to-end platform for securing AI systems across their entire lifecycle (Commercial)
5.Matos AI SPM - AI Security Posture Management solution for AI models, data, and services (Commercial)
Compare all Promptfoo Code Scanning / GitHub Action alternatives at https://cybersectools.com/alternatives/promptfoo-code-scanning-github-action
Promptfoo Code Scanning / GitHub Action is for security teams and organizations that need LLM Security, Prompt Injection, GenAI Security, Agentic AI Security, DEVSECOPS. It's particularly suitable for small to medium-sized teams looking for cost-effective solutions. Other AI Security tools can be found at https://cybersectools.com/categories/ai-security
Have more questions? Browse our categories or search for specific tools.
