loading
Loading content
loading
Static Code Analysis
Report which GitHub repositories use Log4J, and which files reference it.
overview
Reads GitHub source for an org or a single repo and reports Log4J usage plus matching file paths. Code-level inventory, not a runtime probe.
Pass -org to sweep every readable repository, or -o and -r for one owner/repo. -token raises rate limits and reaches private code.
Trickest exposes it as a managed Static Code Analysis node writing a folder and a file. Use log4j-scan or Nuclei when you need live Log4Shell confirmation.
use cases
Pass an org name and a token to scan every repository at once, then collect the list of projects that pull in Log4J for triage.
git-log4j prints the matching file paths, so reviewers go straight to the code that references the library instead of grepping repos by hand.
Point it at one owner/repo pair to confirm whether a specific project ships Log4J, gating a release or vendor assessment on the result.
Supply a GitHub token to reach private repositories, then feed the flagged set into a remediation workflow or ticketing step downstream.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| org-name | STRING | -org | Organization name to scan every repository it owns. |
| repo-name | STRING | -r | Repository name in owner/repo form to scan a single project. |
| github-token | STRING | -token | GitHub token to raise rate limits and reach private repositories. |
| repo-owner-name | STRING | -o | Owner of the repository in owner/repo form. |
Showing key inputs. git-log4j exposes 4 inputs in total.
example
# scan one public repo for Log4J usagegit-log4j -o example -r api-gateway -token "$GITHUB_TOKEN"[+] Checking github.com/example/api-gateway[+] Log4J usage found src/main/java/com/example/App.java src/main/resources/log4j2.xml[+] Checking github.com/example/billing[+] Log4J usage found lib/logger/LogConfig.java[+] Checking github.com/example/docs-site[-] No Log4J usage detectedguidance
Use git-log4j when you need which repositories declare Log4J before deploy. It reads source. Use log4j-scan or a Nuclei template against live hosts for exploitable Log4Shell.
Tests a live host for exploitable Log4Shell over HTTP. git-log4j finds source usage instead of probing a running service.
Broader Git repository scanner. git-log4j is narrowly focused on Log4J presence and the files that import it.
General pattern-based SAST across many rules. git-log4j answers one question: does this repo use Log4J.
faq
related
AST-based security checks for Python source.
Detect hardcoded secrets in git repos and plain directories.
Go AST security scanner for credentials, crypto, and injection.
Regex scan of JavaScript for API keys, tokens, JWTs, and similar client-side secrets.
Static analysis with rules that look like the code they match.
Hunt leaked credentials and verify which still work.
A GitHub organization feeds git-log4j, which scans every repository and writes the projects and files that use Log4J as a queryable output.
Facts on this page come from the live Trickest tool library.