zizmorcore/zizmor

Features

• GitHub Configuration Audits - Scans GitHub Actions workflows to identify security vulnerabilities, misconfigurations, and supply chain risks.
• Workflow Security Auditors - Scans GitHub Actions workflow files to identify security vulnerabilities and configuration risks.
• Vulnerability Detection - Cross-references used actions against the security advisories database to find publicly disclosed vulnerabilities.
• CI CD Pipelines - Hardens CI/CD pipelines by enforcing least privilege permissions and immutable dependencies.
• Security Automation Workflows - Integrates automated security scanning into the development process via git hooks, IDEs, and SARIF export.
• Automated Configuration Remediation - Automatically applies security fixes to identified vulnerabilities in GitHub Actions configuration files.
• Hardcoded Credential Detection - Identifies plain-text Docker usernames and passwords stored directly within workflow files.
• Workflow Security Linters - Provides a static analysis tool that scans GitHub Actions workflow files for security vulnerabilities and misconfigurations.
• Secret Detection - Detects the exposure of the entire secrets context instead of individual secret members.
• Automated Security Remediation - Resolves a subset of identified security findings automatically using safe correction modes.
• CI/CD - Audits pipeline configurations to identify supply chain risks and privilege escalation vectors.
• Software Supply Chain Security - Detects unpinned actions, typosquatted dependencies, and vulnerable third party components within automation workflows.
• Automated Configuration Remediation - Applies safe programmatic edits to workflow files to automatically resolve identified security misconfigurations.
• Action Hash Pinning - Enforces the use of immutable SHA references for GitHub Actions to prevent supply chain attacks.
• Trait-Based Rule Engines - Implements security checks as a set of traits that inspect workflow jobs and steps to identify vulnerabilities.
• Insecure Trigger Detection - Flags triggers that may allow attacker-controlled code to execute in the target repository context.
• Permission Auditing Tools - Detects over-scoped permissions at the workflow or job level to enforce the principle of least privilege.
• YAML AST Analysis - Parses workflow configurations into an abstract syntax tree for deep inspection of logic expressions and structural patterns.
• Hybrid Data Fetching - Combines local filesystem scanning with remote API calls and caching to analyze both private and public repositories.
• IDE Analysis Integrations - Provides an LSP implementation that integrates static analysis findings directly into supported code editors.
• Language Server Implementations - Implements a language server that surfaces security vulnerabilities directly within supported code editors.
• Security Report Exports - Provides security analysis results in multiple standardized machine-readable and human-readable formats including JSON and SARIF.
• Workflow Configuration Discovery - Gathers workflow files and action settings from local directories or remote slugs for further inspection.
• Runner Infrastructure Detectors - Identifies the use of client-managed compute resources which are more difficult to secure than hosted runners.
• Action Reference Filters - Provides an opt-in mechanism to allowlist or denylist specific action references.
• Ad-hoc Installation Detection - Identifies run steps that install packages via commands instead of locked manifests to prevent unpinned versions.
• Analysis Sensitivity Profiles - Adjusts the volume and strictness of reported findings through predefined analysis profiles like pedantic or auditor.
• Archived Repository Detection - Identifies references to archived repositories to prevent supply chain risks from unmaintained code.
• Identity Spoofing Detection - Flags bot identity checks using the actor field that can be bypassed by attackers.
• Build Cache Poisoning Detection - Identifies release workflows that use build state cached from previous executions to prevent attacker code execution.
• Credential Health Audits - Audits for local filesystem git credential storage and potential leaks of credentials into build artifacts.
• Log Redaction Audits - Identifies cases where secrets are treated as structured data, preventing them from being redacted from logs.
• Feature Misconfiguration Detection - Identifies the use of problematic features, such as the Windows CMD shell or specific setup-python inputs.
• Image Pinning Audits - Identifies container images that lack a hash or specific tag to ensure a predictable runtime environment.
• Impostor Commit Detection - Identifies pinned references to commits that exist only in forks but appear to belong to the main repository.
• Insecure Command Detection - Flags the explicit enablement of deprecated and insecure workflow commands via environment variables.
• Insecure Dependency Execution Detection - Flags configurations that allow external code execution during dependency resolution.
• Logic Expression Auditing - Detects insecure use of the contains function that allows for substring bypasses.
• Remote Security Audits - Fetches remote repositories and uses external APIs to provide a deeper analysis of workflow configurations.
• Secret Inheritance Audits - Detects insecure blanket inheritance of secrets between calling and reusable workflows.
• Environment-Scoped Secret Management - Identifies the use of secrets outside of a dedicated environment to reduce the risk of exposure.
• Server-Side Template Injection Detection - Detects template expansions in code contexts that could lead to shell injection via attacker-controllable input.
• Symbolic Reference Audits - Identifies actions pinned to branches or tags that can be manipulated by attackers to deliver malicious code.
• Tool Version Pinning Audits - Finds actions that fetch the latest version of an external tool at runtime instead of a pinned version.
• Typosquatting Detection - Compares action references against a corpus of popular actions to find textual variants owned by different accounts.
• Custom Security Rule Definitions - Allows defining new analysis rules to detect specific vulnerabilities by implementing traits that inspect workflow jobs.
• Environment Variable Injection - Identifies dangerous writes to environment and path variables that could lead to arbitrary code execution.
• Workflow Compliance Auditors - Ensures workflow configurations adhere to organizational standards for naming, documentation, and resource usage.
• Logic Obfuscation - Identifies redundant path segments or no-op expressions designed to hide the actual behavior of a workflow.
• LSP Diagnostic Integrations - Uses the Language Server Protocol to surface security findings and diagnostics directly within supported IDEs.
• Attack and Audit Toolkits - Static analysis tool for securing GitHub Actions workflows.
• Static Analysis - Security analysis tool for GitHub Actions workflows.
• Git Repository Analysis - Performs static analysis on GitHub Actions workflows.
• Vulnerability Auditing - Static analysis for GitHub Actions and CI/CD workflows.

Istoric stele