Tag

workflow-hardening

Safeguard articles tagged "workflow-hardening" — guides, analysis, and best practices for software supply chain and application security.

1 article

Guides

How to Vet a GitHub Action Before You Trust It with Secrets

Third-party Actions run with your repo's token and secrets. A vetting routine: read the source at the pinned SHA, audit the bundled dist, scope permissions, and contain egress.

Jun 22, 20256 min read