Secrets
gitleaks detects exposed credentials and API keys
Eight scanners. One report.
Best-in-class open-source tools, orchestrated and normalized into a single finding schema.
SAST
Semgrep finds code vulnerabilities across 30+ languages
Pipeline Security
zizmor catches dangerous GitHub Actions patterns
Supply Chain
actionlint + poutine detect workflow risks
Dependencies
OSV-Scanner finds CVEs in your packages
Containers
Trivy scans images for vulnerabilities
IaC
Checkov finds Terraform and Kubernetes misconfigs
Unified Report
SARIF, JSON, or PR comment — your choice
How it works
From zero to full security coverage in minutes.
1
Add one line
Drop the Action into any workflow
2
Muninn scans
All 8 scanners run in parallel
3
See results
PR comments, Security tab, or JSON
Why Muninn
Security that fits how teams already ship on GitHub.
Free & Open Source
AGPL-3.0. Self-hostable. No per-seat pricing.
Zero Configuration
Works out of the box. Customize via muninn.yml when ready.
CI/CD Native
Built for GitHub Actions. Results in the Security tab automatically.
Muninn (Old Norse: “Memory”) was one of Odin’s two ravens, sent out each day to observe the world and return with intelligence. We named our scanner after him — because Muninn never forgets what it finds in your code.