ACTIONSCAN

GitHub Actions workflow security scanner -- powered by zizmor, the real open-source scanner. No login.

// We play the villain -- find the pwn request before someone else does

"Pwn request" bugs -- pull_request_target combined with checking out and running untrusted PR code, script injection via ${{ ... }} expansion in run: steps, unpinned third-party actions, secrets handed to fork-triggered workflows -- are a recurring theme in real GitHub Actions security incidents. zizmor is the open-source scanner people recommend for this, but it's CLI/CI-only. Paste a workflow below.

PASTE YAML

FROM URL

0 / 256KB

Try: ·

Verdict