zizmor Security Findings

About

GitHub Actions automates repository workflows such as linting, testing, and deployments. Misconfigured workflows can expose secrets, allow code injection, or enable supply chain attacks.

zizmor statically analyzes workflow files and detects issues such as unpinned action references, template injection, excessive permissions, and insecure secret handling. It does not evaluate the trustworthiness of third-party actions or any runtime behavior.

Security is defense in depth. No single tool eliminates all risk, and a system is only as secure as its weakest component. These findings are one layer worth addressing.

Of the top 10,000 GitHub repositories by stars, —% of those using Actions have at least one high-severity finding. That matters, because many of these open-source projects underpin software that critical systems worldwide depend on.