Analyze GitHub Actions workflows for security risks: script injection, unpinned actions, and secret exposure.
Paste a GitHub Actions workflow to check for three risk classes: untrusted values inserted into scripts, action dependencies referenced by mutable names, and uses of secrets that deserve exposure review. The checker relates findings to the relevant workflow text so you can inspect the reported construct. A clean result is not proof that a workflow is secure. It cannot establish who controls every input, whether a referenced action is trustworthy, or what commands eventually run on a particular runner.
The checker examines workflow commands for GitHub expression substitutions that may place event or context data directly into executable script text. This matters when values such as issue titles, branch names, or pull request metadata can contain shell syntax. A report identifies a potential injection path; deciding whether it is exploitable still requires checking the event trigger, value source, selected shell, quoting, and surrounding command.
Action references are checked for mutable selectors such as branches or version tags instead of a complete commit SHA. Secret references are highlighted where their values enter commands, environments, or action inputs and could cross a trust boundary. These checks answer different questions: pinning constrains which action revision runs, while secret review concerns where sensitive values can travel during a job.
No. It reviews the workflow text in the browser and does not run jobs, resolve action repositories, inspect repository settings, or upload the pasted YAML. Consequently, it cannot observe runtime-generated commands, action behavior, runner contents, organization policies, or the actual values and provenance of event fields. Treat its output as static review findings.
No. The reported categories do not cover every GitHub Actions risk. Review permissions, trigger combinations, checkout behavior, reusable workflows, third-party code, self-hosted runners, environment protection, artifact handling, and credential lifetime separately. The checker is useful for locating specific patterns, but repository context and the behavior of every executed dependency remain part of the security decision.
The behavioral notes were checked against the browser implementation. Standards and primary references below define the relevant format, formula, or platform behavior.
Generate strong, random passwords with customizable length, character sets, and complexity requirements.
Analyze password strength with entropy scoring, crack-time estimates, and improvement suggestions.
Create cryptographically random strings for API keys, tokens, salts, and unique identifiers.
Create QR codes for URLs, text, Wi-Fi credentials, vCards, and more with customizable size and colors.
Scan and decode QR codes from uploaded images or your device camera to extract embedded data.
Compute MD5, SHA-1, SHA-256, and SHA-512 checksums to verify file integrity and detect tampering.