GitHub Actions or CI Pipeline Security Review
Check workflow permissions and third-party actions.
The Open buttons send the prompt text as currently shown below to that site only when you click. Fill in the placeholders first.
Review CI workflow files. Paste the workflow definitions with secrets removed: [WORKFLOW_FILES]. Repository visibility and who can open pull requests: [REPO_ACCESS]. Secrets and environments used: [SECRETS_ENVIRONMENTS]. Check token permissions, use of untrusted input in commands, pinning of third-party actions, secrets exposure to forks, deployment approvals, caching of sensitive files and artifact retention. Explain each risk in plain language without attack steps. Return a table with Workflow, Issue, Severity (red, amber, green) and Fix, hardened workflow excerpts, and a review routine for new workflows. Also suggest a minimal permission template, a rule for adding third-party actions, and a monthly check of workflow changes and secrets usage. Add a plan for what to do if a secret is exposed in a log, including rotation and notification of the owner. Redact personal data and secrets before pasting anything. If the material includes them, stop, tell me what to remove, and continue only with the redacted version.
Fill in before use
Optional: type your details and the prompt above updates. Nothing is saved or sent.
Replace each bracketed placeholder with your own details, then paste into Any AI or another assistant.