A zero-dep CLI that scans your GitHub Actions for the mistakes that actually get repos compromised

Your CI workflow is the softest target in your repo. It runs automatically, it GITHUB_TOKEN that can push commits, and it can read your secrets. The tj-actions/changed-files — all came mutable action , so when the upstream tag got repointed at malicious code, every consumer The uncomfortable stat: 7