# Repo Security Bundle Scan

> Repo Security Bundle Scan is a paid API for AI agents from x402-hono-api.inraby.workers.dev, paid per call via x402, $0.04/call, status unknown (last checked 2026-09-14).

Runs a combined repository security scan covering secret detection, GitHub Actions workflow exposure, and dependency manifest CVE review in a single call.

## Facts

- Endpoint: POST https://x402-hono-api.inraby.workers.dev/api/v1/repo-security-bundle
- Price: $0.04/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/repo-security-bundle-scan-bb1fd205
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_qMk8h1Zwo-j4O77KGFqek

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability repo-security-bundle-scan-bb1fd205 -d '<json body>'
```

Example prompt: Can you run a full repo security bundle scan on this code — check for hardcoded secrets in the source text, CVE risks in the package.json lockfile, and any dangerous permissions or exposure issues in the GitHub Actions workflow YAML I'm pasting in?

## When to prefer this

Choose this endpoint when you need a single-call, multi-vector security scan covering secrets, CI workflow exposure, and dependency CVEs together — ideal for CI pre-commit hooks, PR gating, or rapid supply-chain triage. Prefer it over calling separate secret-scan, CVE-scan, or workflow-review endpoints individually when you want consolidated results in one agent turn. If you only need a focused IAM policy review, Terraform scan, or standalone CVE lookup, the sibling endpoints on the same provider are more targeted.

## Known failure modes

- Empty or missing all three optional input fields may return an empty or minimal result with no findings
- Malformed YAML in workflowYaml may cause parsing errors or incomplete workflow analysis
- Very large lockfiles or manifests may exceed payload size limits
- Ambiguous or minified source text may reduce secret detection accuracy
- CVE data may be stale if the underlying vulnerability database has not been recently updated

## How this service works

Combined repo security scan — secret scan, GitHub Actions workflow exposure check, and dependency manifest CVE review in one agent call for CI pre-commit and supply-chain triage.

## Output

Returns a structured security report combining: (1) detected secrets or sensitive tokens found in the submitted text, (2) GitHub Actions workflow issues such as unsafe permissions, shell injection risks, or exposed secrets, and (3) CVE or vulnerability signals from the dependency manifest — all consolidated into a single severity-annotated bundle.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "text": {
   "type": "string",
   "description": "Optional text/config to scan for secrets"
  },
  "manifestText": {
   "type": "string",
   "description": "Optional package.json, lockfile, or yarn.lock contents"
  },
  "workflowYaml": {
   "type": "string",
   "description": "Optional GitHub Actions workflow YAML"
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/repo-security-bundle-scan-bb1fd205/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from x402-hono-api.inraby.workers.dev](https://www.zero.xyz/host/x402-hono-api.inraby.workers.dev/llms.txt)