DevSecOps · free tool + paid report

GitHub Actions Workflow Security Audit

A free GitHub Action flags unpinned action refs, over-broad GITHUB_TOKEN permissions, and script-injection patterns in your workflows. The paid report turns those findings into ready-to-merge fixes across every workflow in the org.

Free Action available now. The planned $69 org-wide remediation report is not available for purchase yet. The free tool reports findings; the report delivers pinned-SHA and least-privilege patches as ready-to-merge changes. It is a static workflow audit, not a guarantee of security.

Get the free GitHub Action

No contact details, checkout, or payment. Measurement retains a random per-tab ID, IP address, browser user agent, referrer, page, and classification so internal and automated traffic can be excluded.

Free tool vs paid report

The free Action finds

Unpinned uses: actions/checkout@v4 (a tag, not a 40-character SHA); a job with permissions: write-all; a run: step interpolating ${{ github.event.pull_request.title }}.

The paid report adds

Every finding across every workflow in the org, each rewritten to a pinned commit SHA and a least-privilege token scope, delivered as ready-to-merge patch files with a prioritized rollout order and a re-audit confirming each is closed.

Representative synthetic excerpt. The free Action runs entirely in your CI and sends nothing out. The paid report is produced from workflow files you provide, with independent QA before delivery.