GitHub Actions security & cost review
A human review of your workflow files with a one-page pass/fail report: unpinned actions, over-broad GITHUB_TOKEN permissions, risky pull_request_target triggers, script injection — plus wasted CI minutes.
Every third-party action pinned to a full commit SHA, not a movable tag like @v4 or @main.
Least-privilege permissions: per workflow and job; no write-all; OIDC instead of long-lived cloud keys.
pull_request_target and workflow_run misuse, and untrusted issue/PR text expanded into shell scripts.
Secrets scoped to environments, not echoed, not exposed to fork PRs.
Caching, concurrency cancel, path filters, runner size choice — with an estimated monthly saving.
On the Full tier you get a pull request with the fixes applied, ready to review and merge.
Fixed prices in USD. We confirm scope in writing before work starts. If we can't deliver, you get a full refund.
1 workflow file: pinning, permissions, triggers, injection. One-page pass/fail report.
Up to 5 workflows, plus cost review: caching, concurrency, runner choice, estimated monthly saving.
All workflows in one repository, the report, and a pull request with the fixes applied.
Want to try it yourself first? Run our free open-source scanner actions-harden, or estimate your bill with the free CI cost check.
No. Public repo link or the YAML files are enough. For private repos, send the files. Never send secrets.
No. It's a static review of your workflow configuration. We don't test or touch your systems.
Yes — choose bank transfer and we'll email the details.