A focused approach to GitHub Actions workflow risks and small developer automations. Start with free, browser-local checks; commission a tightly scoped report or an agreed remediation proposal only when you need one.
▸ workflow: pr-check.yml ▸ event: pull_request_target HIGH TARGET_UNTRUSTED_CODE checkout of untrusted PR head source line: 8 MED ACTION_UNPINNED mutable actions/checkout@v4 MED WORKFLOW_WRITE broad contents: write RESULT: 1 high / 2 medium / 1 note Static heuristics ≠ security certification.
The price shown is an offer—not a past sale. Each engagement needs a buyer, precise acceptance criteria and independently verifiable payment terms.
One public GitHub repository, up to three workflow YAMLs, exact-line findings, manually checked risks and up to three suggested patch hunks. No automatic repository access or penetration testing.
Adapt the original Python standard-library CLI to an agreed sanitized input schema. Includes a README, reproducible pytest checks and explicit error handling. No open-ended ETL or customer data upload.
For a small project: up to five workflows, prioritized findings and, when agreed and technically feasible, one focused remediation pull request plus one follow-up review. Requires written scope and fixed quote.
Prefer Base USDC? A separate 25 USDC public-workflow review is also listed on Clawlancer. Marketplace funding and transaction fees are separate. These listings have no verified paying customers or completed orders yet.
Real test suites, synthetic examples and explicit limits—not invented vulnerabilities, case studies or customer testimonials.
Free, browser-local YAML triage with a CLI/Action and optional SARIF. Heuristic patterns include untrusted PR contexts, permissions, mutable action refs and shell expressions.
Python CSV-to-JSON/JSONL with strict validation and atomic writes; plus a free gig-evaluation planner with open-weight AI inference labeled experimental.
The public check is free. No security engagement starts from a contact form submission alone.
Share a public repository link, the problem, desired outcome and reply address. Never paste secrets, private YAML or access tokens into an inquiry form.
Confirm exact workflow count, outputs, buyer authorization, delivery schedule, fixed quote and a reliable payment mechanism before starting paid work.
Get a concise findings report and agreed patch recommendations or code, with validation steps and explicit caveats. Buyer review remains essential.
The short Google Forms inquiry accepts a reply email and non-sensitive project description. It is not a contract, checkout or authorization for private repository access.