Cybersecurity · free, no signup
GitHub Actions Workflow Analyzer
Paste a GitHub Actions workflow and see the patterns that turn a pull request into code execution with your credentials. The headline is pull_request_target combined with an explicit checkout of the PR head: that trigger exists so a workflow can label or comment on a fork’s pull request, so it runs in the base repository’s context where secrets resolve and the token can write, and it deliberately does NOT check out the fork’s diff. Adding that checkout puts the untrusted tree back in, and from that moment a postinstall hook, a Makefile target or a conftest.py decides what runs — opening the pull request is the whole exploit. Also covers script injection, where an attacker-writable context is interpolated straight into a run block and a pull request title becomes the next command; actions pinned to a mutable tag rather than a commit SHA, with first-party graded separately from third-party; missing permissions blocks; and secrets: inherit passed to a reusable workflow.
Authorized, defensive use only. Check assets you own or lawfully public data. This tool is educational and never provides another party's private data.
Paste a GitHub Actions workflow and see the patterns that turn a pull request into code execution with your credentials. The headline: pull_request_target plus a checkout of the PR head. That trigger runs in the base repository's context — where secrets resolve and the token can write — and deliberately does not check out the fork's diff. Adding that checkout puts it back in, and opening the pull request is the whole exploit.
Only this file is read. Reusable workflows, composite actions and the scripts it runs are one level down and out of scope. Nothing is fetched — no action, tag or SHA named in the file is resolved, so a pinned SHA is checked for shape, not for what it points at.
What happens to what you enter
- The analysis runs on Solvex servers. What is recorded afterwards is a SHA-256 hash of your input and a coarse summary of the outcome — never the input itself, and never a result you could be identified from.
- Tools that read public sources (certificate logs, DNS, a public chain) contact those sources from our servers through a fetcher that refuses private and internal addresses.
- An email address is stored only where a tool offers to send you a report and you choose to give one.
Limits: ten runs of this tool per minute from one address, and three signed reports per minute. Past that the tool says so and tells you when to try again.
When a free check is not enough
This tool reads what is public and reports what it can see. The DevSecOps CI/CD Pipeline Audit engagement is the authorized, specialist-led version: signed scope, findings proven by hand, a signed report, and a retest.
Explore DevSecOps CI/CD Pipeline Audit