Add telemetry option

.github/workflows/ci.yml

@@ -76,7 +76,7 @@ jobs:
         run: |
           echo "jwt=$(docker run --rm ${{ env.DOCKER_IMAGE }} jwt)" >> $GITHUB_OUTPUT
 
-      - name: Test CURL Local Action
+      - name: Test cURL Local Action
         uses: ./
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -85,13 +85,24 @@ jobs:
           curl: |
             curl http://localhost:8080 -H "Authorization: Bearer ${{ steps.get-jwt.outputs.jwt }}"
 
+      - name: Test cURL Local Action without Telemetry
+        uses: ./
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          scans: jwt.*
+          curl: |
+            curl http://localhost:8080 -H "Authorization: Bearer ${{ steps.get-jwt.outputs.jwt }}"
+          telemetry: false
+
       # - name: Test OpenAPI Local Action
       #   uses: ./
       #   env:
       #     GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       #   with:
       #     scans: jwt.*
       #     openapi: ./__tests__/openapi.yaml
+      #     telemetry: false
 
       - name: Stop Server
         if: ${{ always() }}

README.md

@@ -111,21 +111,27 @@ jobs:
 
 | Name              | Required | Description                                         | Default |
 | ----------------- | -------- | --------------------------------------------------- | ------- |
-| scans             | false    | The scans performed.                                | all     |
+| scans             | false    | The scans performed.                                | `all`   |
 | excludeScans      | false    | The scans to exclude.                               |         |
-| rateLimit         | false    | The rate limit used to run API vulnerability scans. | 10/s    |
+| rateLimit         | false    | The rate limit used to run API vulnerability scans. | `10/s`  |
 | proxy             | false    | The proxy server used during the scan.              |         |
-| severityThreshold | false    | The severity threshold to trigger a failure.        | 0       |
+| severityThreshold | false    | The severity threshold to trigger a failure.        | `0`     |
 
 ## Outputs
 
 Scan results are output to the console.
 
 ## Disclaimer
 
-This scanner is provided for educational and informational purposes only. It
-should not be used for malicious purposes or to attack any system without proper
-authorization. Always respect the security and privacy of others.
+This scanner is provided for informational purposes only. It should not be used
+for malicious purposes or to attack any system without proper authorization.
+Always respect the security and privacy of others.
+
+## Telemetry
+
+VulnAPI collects fully anonymized usage data to help improve the tool. This data
+is not shared with third parties. You can opt-out of telemetry by setting the
+`telemetry` option to `false`.
 
 ## License
 

action.yml

@@ -34,6 +34,13 @@ inputs:
     required: false
     default: 10/s
 
+  telemetry:
+    description:
+      'VulnAPI uses fully anonymized telemetry data to help improve the tool.
+      You can disable it by setting this to false.'
+    required: false
+    default: 'true'
+
   proxy:
     description: 'The proxy server used during the scan'
     required: false

src/main.js

@@ -27,6 +27,11 @@ function getCommonArgs() {
     commonArgs.push(`--rate-limit=${rateLimit}`)
   }
 
+  const telemetry = getInput('telemetry')
+  if (telemetry && (telemetry === 'false' || telemetry === '0')) {
+    commonArgs.push('--sqa-opt-out')
+  }
+
   const scans = getInput('scans')
   if (scans) {
     commonArgs.push(`--scans=${scans}`)