Secrets
gitleaks detects exposed credentials and API keys
Eight scanners. One report.
Best-in-class open-source tools, orchestrated and normalized into a single finding schema.
SAST
Semgrep finds code vulnerabilities across 30+ languages
Pipeline Security
zizmor catches dangerous GitHub Actions patterns
Supply Chain
actionlint + poutine detect workflow risks
Dependencies
OSV-Scanner finds CVEs in your packages
Containers
Trivy scans images for vulnerabilities
IaC
Checkov finds Terraform and Kubernetes misconfigs
Unified Report
SARIF, JSON, or PR comment — your choice
How it works
From zero to full security coverage in minutes.
1
Add one line
Drop the Action into any workflow
2
Muninn scans
All 8 scanners run in parallel
3
See results
PR comments, Security tab, or JSON
Why Muninn
Security that fits how teams already ship on GitHub.
Free & Open Source
AGPL-3.0. Self-hostable. No per-seat pricing.
Zero Configuration
Works out of the box. Customize via muninn.yml when ready.
CI/CD Native
Built for GitHub Actions. Results in the Security tab automatically.
About Skald Lab
Developer security tools from Montevideo, Uruguay.
Skald Lab is an independent software studio focused on practical security for teams that ship on GitHub. We believe every pull request deserves the same depth of scanning that large platform teams run internally — without juggling eight different tools, formats, and CI jobs.
Our flagship project, Muninn, orchestrates gitleaks, Semgrep, zizmor, actionlint, poutine, OSV-Scanner, Trivy, and Checkov into one normalized report. Add a single uses: line to your workflow and Muninn posts PR comments, uploads SARIF to the Security tab, or emits JSON for downstream tooling. Customize scanners and suppressions in muninn.yml when you are ready.
Next steps: copy the workflow snippet above, star muninn on GitHub, or install it from the Marketplace. Questions and vulnerability reports go to security@skaldlab.dev. Follow @skaldlab for release news.
Muninn (Old Norse: “Memory”) was one of Odin’s two ravens, sent out each day to observe the world and return with intelligence. We named our scanner after him — because Muninn never forgets what it finds in your code.