Integrations

Ship the check with the code, not after it.

GitHub Action

Add a security check to every pull request. The action scans a deployed URL, comments the findings on the PR, and fails the job when critical issues are found.

Create .github/workflows/trustfield.yml:

name: Trustfield security scan
on:
  pull_request:
  workflow_dispatch:

jobs:
  trustfield:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: kumardhruv87-hue/trustfield@main
        with:
          url: https://staging.example.com
          fail-on: critical   # critical | high | never
          comment: true
          ai: false

Only scan apps you own or control. Use a staging URL if production needs a login. The action never scans anything that is not in the workflow file.

Input	Default	Meaning
`url`	— (required)	Public URL of the app to scan
`fail-on`	`critical`	Fail the job on `critical`, `high`, or `never`
`comment`	`true`	Post a summary comment on the pull request
`ai`	`false`	Run the AI prompt-injection checks too

JSON API

Any tool can start a scan with one POST. No key is needed today; requests are rate-limited per IP.

curl -s https://trustfield.dev/api/scan \
  -H 'Content-Type: application/json' \
  -d '{"kind":"url","target":"https://your-app.com","consent":true}'

Response (abridged):

{
  "ok": true,
  "id": "a1b2c3d4e5",
  "score": 72,
  "grade": "C",
  "locked": true,
  "total": 9,
  "counts": {"critical": 1, "high": 2, "medium": 3, "low": 3},
  "teaser": [{"title": "...", "severity": "critical"}],
  "report_url": "/r/a1b2c3d4e5"
}

Planned

API keys — per-team keys, higher limits, webhook on completion.
Slack / Discord alerts — post new findings to a channel.
CLI — npx trustfield scan for local CI.
Watch — scheduled re-scans that email only when something new appears.

Want one of these first? Email info@trustfield.dev and say which one.

Trustfield is an external, read-only check. It is not a penetration test and not a certification. Read the methodology.