Static Code Analysis
List Log4J usage across GitHub repositories
Report which GitHub repositories use Log4J, and which files reference it.
overview
What git-log4j does
Reads GitHub source for an org or a single repo and reports Log4J usage plus matching file paths. Code-level inventory, not a runtime probe.
Pass -org to sweep every readable repository, or -o and -r for one owner/repo. -token raises rate limits and reaches private code.
Trickest exposes it as a managed Static Code Analysis node writing a folder and a file. Use log4j-scan or Nuclei when you need live Log4Shell confirmation.
use cases
Where git-log4j fits
Sweep an organization for Log4J exposure
Pass an org name and a token to scan every repository at once, then collect the list of projects that pull in Log4J for triage.
Pinpoint the files that use Log4J
git-log4j prints the matching file paths, so reviewers go straight to the code that references the library instead of grepping repos by hand.
Audit a single repository before release
Point it at one owner/repo pair to confirm whether a specific project ships Log4J, gating a release or vendor assessment on the result.
Triage Log4Shell across private code
Supply a GitHub token to reach private repositories, then feed the flagged set into a remediation workflow or ticketing step downstream.
reference
git-log4j inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| org-name | STRING | -org | Organization name to scan every repository it owns. |
| repo-name | STRING | -r | Repository name in owner/repo form to scan a single project. |
| github-token | STRING | -token | GitHub token to raise rate limits and reach private repositories. |
| repo-owner-name | STRING | -o | Owner of the repository in owner/repo form. |
Showing key inputs. git-log4j exposes 4 inputs in total.
example
Run git-log4j
# scan one public repo for Log4J usagegit-log4j -o example -r api-gateway -token "$GITHUB_TOKEN"[+] Checking github.com/example/api-gateway[+] Log4J usage found src/main/java/com/example/App.java src/main/resources/log4j2.xml[+] Checking github.com/example/billing[+] Log4J usage found lib/logger/LogConfig.java[+] Checking github.com/example/docs-site[-] No Log4J usage detectedguidance
Choosing git-log4j
Use git-log4j when you need which repositories declare Log4J before deploy. It reads source. Use log4j-scan or a Nuclei template against live hosts for exploitable Log4Shell.
log4j-scan
Tests a live host for exploitable Log4Shell over HTTP. git-log4j finds source usage instead of probing a running service.
reposcanner
Broader Git repository scanner. git-log4j is narrowly focused on Log4J presence and the files that import it.
semgrep-scan
General pattern-based SAST across many rules. git-log4j answers one question: does this repo use Log4J.
faq
git-log4j questions
related
More Static Code Analysis tools
bandit
AST-based security checks for Python source.
gitleaks
Detect hardcoded secrets in git repos and plain directories.
gosec
Go AST security scanner for credentials, crypto, and injection.
secretfinder
Regex scan of JavaScript for API keys, tokens, JWTs, and similar client-side secrets.
semgrep-scan
Static analysis with rules that look like the code they match.
trufflehog
Hunt leaked credentials and verify which still work.
Run git-log4j yourself
A GitHub organization feeds git-log4j, which scans every repository and writes the projects and files that use Log4J as a queryable output.
Facts on this page come from the live Trickest tool library.