# Promptfoo Code Scanning / GitHub Action

Promptfoo Code Scanning / GitHub Action is a Static Application Security Testing product by Promptfoo. It runs in the cloud. Pricing is free.

GitHub Action scanner for LLM-specific app vulnerabilities like prompt injection.

Checked October 2026.

## What is Promptfoo Code Scanning / GitHub Action?

Promptfoo Code Scanning is a GitHub Action-based security scanner designed to detect vulnerabilities specific to applications built on large language models (LLMs) and AI agents. It integrates into the pull request (PR) review workflow and performs agentic code tracing to identify security issues before they reach production.

The scanner focuses on LLM-specific vulnerability classes, including:
- Prompt Injection: untrusted input reaching LLM prompts without sanitization
- Data Exfiltration: indirect prompt injection vectors that could extract data through agent tools
- PII Exposure: code that may leak sensitive user data to LLMs or log confidential information
- Improper Output Handling: LLM outputs used in dangerous contexts such as SQL queries or shell commands
- Excessive Agency: LLMs with overly broad tool access or missing approval gates
- Jailbreak Risks: weak system prompts or guardrail bypasses that could allow harmful outputs

Key operational characteristics:
- Deep tracing: the scanner goes beyond the PR diff, tracing LLM inputs, outputs, and capability changes throughout the broader repository
- Low false-positive design: maintains a high reporting bar to reduce alert fatigue; maintainers can configure severity levels and provide custom instructions
- Fix suggestions: each finding includes a suggested remediation and a prompt that can be passed to an AI coding agent for further investigation and resolution

The tool has been tested against real CVEs in LangChain, Vanna.AI, and LlamaIndex. No account, credit card, or API keys are required to get started.

Tags: LLM Security, Prompt Injection, GenAI Security, Agentic AI Security, DevSecOps, CI/CD, Scanner, Security Scanning, PII, Data Exfiltration

## Where it fits in your security program (NIST CSF 2.0)

- [Identify](https://cybersectools.com/guides/building-identify-program-small-team): helps you know your assets and your risks.
- [Protect](https://cybersectools.com/guides/building-protect-program-small-team): helps you prevent attacks and keep data safe.

## Quick facts

- Category: [Application Security](https://cybersectools.com/categories/application-security) · [Static Application Security Testing](https://cybersectools.com/categories/sast)
- Vendor: [Promptfoo](https://cybersectools.com/companies/promptfoo)
- Deployment: Cloud
- Company size fit: Startup, SMB, Mid-Market, Enterprise
- Pricing model: Free
- Features: 9 listed
- Integrations: 2 listed
- Website: promptfoo.dev

The full feature and integration lists are on the page for signed-in visitors.

## Where it ranks

Promptfoo Code Scanning / GitHub Action is not a pick on the current [Best SAST Solutions for Business](https://cybersectools.com/shortlists/best-sast-solutions).

## Promptfoo Code Scanning / GitHub Action FAQ

### What is Promptfoo Code Scanning / GitHub Action?

Promptfoo Code Scanning / GitHub Action is a product by Promptfoo in the Static Application Security Testing category. It covers LLM Security, Prompt Injection and GenAI Security.

### What is the pricing for Promptfoo Code Scanning / GitHub Action?

Promptfoo Code Scanning / GitHub Action is free. Download and setup instructions are at https://www.promptfoo.dev/code-scanning/github-action/.

### What are alternatives to Promptfoo Code Scanning / GitHub Action?

Alternatives to Promptfoo Code Scanning / GitHub Action listed on CybersecTools:

1. [Dam Secure](https://cybersectools.com/tools/dam-secure) - IDE-native guardrails that enforce security rules on AI-generated code in real time. (Commercial)
2. [DeepSource SAST](https://cybersectools.com/tools/deepsource-sast) - SAST engine that scans code commits for security vulnerabilities (Commercial)
3. [Meterian ISAAC](https://cybersectools.com/tools/meterian-isaac) - IaC scanner detecting misconfigs, vulnerabilities & policy violations in templates. (Commercial)
4. [SOOS SAST](https://cybersectools.com/tools/soos-sast) - SAST platform that runs scans and ingests SARIF results into a unified dashboard. (Commercial)
5. [Adronite](https://cybersectools.com/tools/adronite) - AI-powered secure code platform for vulnerability detection & codebase analysis. (Commercial)

Compare all Promptfoo Code Scanning / GitHub Action alternatives at [https://cybersectools.com/alternatives/promptfoo-code-scanning-github-action](https://cybersectools.com/alternatives/promptfoo-code-scanning-github-action)

### What deployment and organization size does Promptfoo Code Scanning / GitHub Action fit?

Promptfoo Code Scanning / GitHub Action is available as cloud. It is listed for startup, smb, mid-market and enterprise organizations. It is free.

## Compare Promptfoo Code Scanning / GitHub Action with similar solutions

- [Promptfoo Code Scanning / GitHub Action vs Dam Secure](https://cybersectools.com/compare/dam-secure-vs-promptfoo-code-scanning-github-action)
- [Promptfoo Code Scanning / GitHub Action vs DeepSource SAST](https://cybersectools.com/compare/deepsource-sast-vs-promptfoo-code-scanning-github-action)
- [Promptfoo Code Scanning / GitHub Action vs Meterian ISAAC](https://cybersectools.com/compare/meterian-isaac-vs-promptfoo-code-scanning-github-action)

All alternatives to Promptfoo Code Scanning / GitHub Action: [/alternatives/promptfoo-code-scanning-github-action](https://cybersectools.com/alternatives/promptfoo-code-scanning-github-action)

---

Source: https://cybersectools.com/tools/promptfoo-code-scanning-github-action

For AI agents: every CybersecTools shortlist is listed at https://cybersectools.com/shortlists.md, and any compare page has a Markdown copy too (add .md to its URL).

More on Promptfoo Code Scanning / GitHub Action and Promptfoo: funding, momentum, hiring and news, plus the full product and company record, are available through the Mandos MCP Server (paid plans), which connects to AI assistants: https://mandos.io/mcp?utm_source=cybersectools.com&utm_medium=product-md