FREE & OPEN SOURCE · RUNS IN YOUR BROWSER

Your workflows ship code.
Check what they trust.

Catch common GitHub Actions security footguns before they reach your default branch. Paste a workflow, get concrete findings, and see what to change—without uploading the file.

Run the free check Need the fix done?

GitHub Actions policy update: The default pull_request_target policy changes Nov 2, 2026 for affected public repositories.Readiness checklist ↗ · 한국어 안내 ↗

✓ No account✓ No tracking✓ Client-side parsing✓ Shareable Markdown report

01GITHUB_TOKEN scopes

02Mutable action refs

03Untrusted PR execution

04Runner & secret exposure

THE CHECKER / FREE

Inspect your workflow.

Paste a .github/workflows/*.yml file or select it locally. No network request is made for the contents.

SECURITY PRECHECK / 01

◆ workflow.ymlYAML · 240 KB max

Choose .yml file

This tool only applies static heuristics. It does not execute workflow code, contact your repositories, or establish that a workflow is secure.

↳ Diagnostic reportREADY

⌕

No workflow analyzed yet.

Your findings will appear here with practical remediation guidance and links to source documentation.

Your YAML stays in this tab.

WHY THIS EXISTS

Security fixes shouldn't
start with guesswork.

◎

Readable findings

Get a precise job/step location, impact explanation, and next action—not a mysterious risk score.

⌁

Private by design

Workflow contents are parsed locally with bundled code. No registration, telemetry, or document upload.

↗

From finding to fix

Use the Markdown report in an issue, or request a scoped remediation PR from a qualified maintainer.

ALWAYS-ON / FREE GITHUB ACTION

Put the check
in every pull request.

Run the same preflight automatically in CI. Your workflow files stay on the GitHub runner; the action has no external API calls and only needs read access.

✓ Zero API keys✓ PR annotations + SARIF✓ Configurable failure threshold

See GitHub Action setup

Step-by-step: upload SARIF reports to GitHub Code Scanning ↗

workflow-risk-check.ymlCOPY INTO .github/workflows/

# Run on pull requests
on: [pull_request]
permissions:
  contents: read
jobs:
  workflow-security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: livastic-vm2-primary-20260911/workflow-risk-check@v1.2.0
        with:
          fail_level: high
          sarif_file: reports/workflow-risk.sarif

Example for readability; pin actions to reviewed commit SHAs in production.

THE SERVICE / SCOPE-AGREED WORK

Want those findings
actually fixed?

Get a practical hardening pass for GitHub Actions, with focused changes and a clear explanation. Work begins only after we agree on repository access, exact scope, delivery, and payment terms.

Least-privilege tokensAction pinningPR trust boundariesReproducible PR

STARTING PRICE / QUOTE REQUIRED

$149 USD

Small-repository GitHub Actions remediation

Initial review of up to 5 workflow YAML files
Documented issues with priority levels
One focused remediation pull request
One follow-up review round

Request a private scope inquiry

The inquiry form is hosted by Google Forms, stores your reply email and non-sensitive summary for review, and needs no GitHub account. Do not include credentials, proprietary source code, or secrets. Quote and delivery depend on fit and availability; no payment is collected here. Public GitHub issue alternative ↗

Smaller public-only review: 25 USDC on Clawlancer (Base) covers up to 3 publicly accessible workflows, a prioritized evidence report and suggested YAML patch notes—not the $149 remediation PR package. Buyers need marketplace payment setup and Base USDC/gas; start only after escrow and exact scope are confirmed. View a synthetic sample report ↗. No paid orders or settled revenue are claimed.

USD marketplace alternative: The same small public-only CI review is listed for 25 USD on dealwork.ai (public API listing details). A buyer must place and fund the order through dealwork.ai; this static checker does not take payment. The posted price is not received income. No contract, escrow or sale has been verified.

DETAILS

Read before you rely on it.

Is this a complete security audit?

No. It checks selected, high-signal patterns in a single workflow file. It cannot inspect runtime behavior, repository settings, external actions, or other workflows.

Does the checker transmit my YAML?

No. The parser and analyzer run in your browser and the interface has no document-upload or analytics endpoint. Source links only open if you click them.

Are unpinned tags always vulnerable?

No. Mutable refs are a supply-chain exposure, not proof of an active compromise. Findings are prompts for review and control improvements.

How do I request paid help?

Submit the short Google Forms scope inquiry with a reply email and non-sensitive project summary (no GitHub sign-in required), or use the public GitHub issue alternative. We'll confirm access method, exact deliverables, timeline and a fixed quote before any paid work starts.

How can I clarify the scope before requesting a quote?

Consider ScopeLens, a separate free, local-first brief checklist. It can help structure deliverables, acceptance criteria and payment terms; it is not a security audit or paid partnership.

Your workflows ship code.Check what they trust.