zizmor is a static analysis tool for CI/CD systems.
It can find and fix security issues in common CI/CD setups, including GitHub Actions,
Dependabot, and pre-commit. Some of the things zizmor finds:
- Template injection vulnerabilities, leading to attacker-controlled code execution
- Accidental credential persistence and leakage
- Excessive permission scopes and credential grants to runners
- Impostor commits and confusable
gitreferences - ...and much more!
See zizmor's documentation
for installation steps, as well as a quickstart and
detailed usage recipes.
zizmor is licensed under the MIT License.
Now you can have beautiful clean workflows!
zizmor's development is supported by these amazing sponsors!
Grafana Labs |
Trail of Bits |
Kusari |
Tracebit |
Name-level sponsors
| Alexander Riccio | Carol Willing |
Want to see your name or logo above? Consider becoming a sponsor through one of the following:
- GitHub Sponsors (preferred)
- thanks.dev
- ko-fi
