flowcheck

The default GitHub token can write to your repo. Most workflows never check.

Every GitHub Actions workflow runs with a GITHUB_TOKEN. Repos created with legacy settings give that token write access to nearly everything, and a workflow with no permissions: block inherits whatever the repo default is. Add the trigger shapes that check out pull request code inside a privileged context, secrets passed wholesale to reusable workflows, and caches written by PR runs and read back by release runs, and the workflow file itself becomes the attack surface. The 2025 tj-actions compromise showed how fast a trusted action can turn; "pwn request" write-ups have shown the same for checkouts of PR heads for years.