Paste a workflow file. This flags the patterns that get CI pipelines owned — ${{ github.event.* }} in a run: step, pull_request_target that builds fork code, actions pinned to a moveable tag. Static scan, nothing leaves the page.
.github/workflows/*.yml)Nothing is stored or logged. The file is scanned line by line in memory — no YAML is executed, no network call is made, no repo is touched.
github.event.pull_request.title, .body, comment.body, head_commit.message, github.head_ref, …) interpolated into a run: block. GitHub substitutes ${{ }} into the script before the shell parses it, so a crafted PR title runs as a command.pull_request_target / workflow_run (which carry repo secrets and a write token) checking out github.event.pull_request.head.sha / github.head_ref and then running it.uses: on a tag or branch instead of a full commit SHA (the tj-actions/changed-files tag-rewrite incident, March 2025).permissions: — no top-level block (token inherits a write-all default on older repos) or write-all.run: — ${{ secrets.* }} inlined into a script instead of mapped through env:, where set -x / crash dumps / /proc can leak it.curl … | bash with no checksum. Deprecated command injection — ACTIONS_ALLOW_UNSECURE_COMMANDS. Self-hosted runners on workflows reachable by fork PRs. Username-string authz in if:.Independent checklist built from GitHub's Security hardening for GitHub Actions and GitHub Security Lab's untrusted-input research. Not affiliated with GitHub. It is a heuristic line scanner — a clean result means no known-bad pattern matched, not that the pipeline is audited.