Parse GitHub Actions YAML locally and flag broad permissions, mutable actions, expression injection, risky pull-request targets, self-hosted runner exposure and weak OIDC controls.
Up to 100 YAML files, 1 MB each and 10 MB total.
Review workflow trust boundaries before automation runs. Parse GitHub Actions YAML locally and flag broad permissions, mutable actions, expression injection, risky pull-request targets, self-hosted runner exposure and weak OIDC controls. The core workflow is designed to run in your current browser.
Yes. GitHub Actions Security Auditor opens in a modern browser and does not require desktop software installation.
Common use cases include Review pull-request workflows and fork trust boundaries; Audit release jobs before granting write or identity-token permissions.
The core processing workflow is designed to run locally in the browser. Key capabilities include Parse multiple YAML workflows locally without executing expressions, Review workflow and job token permissions with least privilege in mind, Find untrusted event expressions used directly in shell scripts; account, comments, and anonymous analytics may still create normal site requests.
0 comments
Sign in to comment and reply.
