Skip to content

docs: first-screen treatment for both READMEs #34

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
9t29zhmwdh-coder merged 1 commit into from
Jul 31, 2026
Merged

docs: first-screen treatment for both READMEs #34

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,13 @@
# Changelog

## [0.3.6] - 2026-07-31

### Changed

- Both READMEs now open with three named workflow mistakes and what each one hands an attacker, rather than with the vulnerability classes the scanner detects. A short paragraph is honest that a private repository with trusted contributors has little of this surface, so the findings there stay theoretical.

---

## [0.3.5] - 2026-07-29

### Security
Expand Down
2 changes: 1 addition & 1 deletion Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,5 +3,5 @@ members = ["crates/ghass-core", "crates/ghass-scan", "crates/ghass-cli"]
resolver = "2"

[workspace.package]
version = "0.3.5"
version = "0.3.6"
edition = "2021"
28 changes: 26 additions & 2 deletions README.de.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,9 +5,33 @@

[🇬🇧 English Version](README.md)

**Statische Analyse und Angriffssimulation für GitHub Actions Workflows. Erkennt Injection-Vektoren, Supply-Chain-Risiken, überprivilegierte Berechtigungen und Secret-Exposition. Generiert priorisierte Findings mit konkreten Behebungshinweisen.**
**Liest deine Workflow-Dateien und zeigt auf die Zeilen, über die ein Fremder an deine Secrets kommt.**

Ausgerichtet an den [Microsoft Security DevOps](https://learn.microsoft.com/de-de/azure/defender-for-cloud/azure-devops-extension) Grundsätzen. Der SARIF 2.1.0-Output integriert sich nativ in [GitHub Advanced Security (GHAS)](https://docs.github.com/en/get-started/learning-about-github/about-github-advanced-security) für Enterprise Security Workflows.
Ein Workflow ist ein Shell-Skript, in dessen Reichweite deine
Deployment-Zugangsdaten liegen, und die Wege, auf denen das schiefgeht, sehen
nicht nach Fehlern aus. `${{ github.event.issue.title }}` in einem `run:`-Block
ist Befehlsausführung für jeden, der ein Issue aufmachen kann.
`pull_request_target` auf ungeprüftem Code reicht dem Fork deine Secrets. Eine
Action, die auf einen Tag gepinnt ist, ist ein Versprechen, das ihr Besitzer
brechen kann.

```
ghass scan .github/workflows was ausnutzbar ist, sortiert
ghass scan --format sarif rein in GitHub Advanced Security
```

Es liest das YAML und sonst nichts: kein Kontakt zu GitHub, kein Workflow wird
ausgeführt. Der SARIF-2.1.0-Output geht direkt ins Code-Scanning von [GitHub
Advanced Security
(GHAS)](https://docs.github.com/en/get-started/learning-about-github/about-github-advanced-security).
Ausgerichtet an den [Microsoft Security
DevOps](https://learn.microsoft.com/de-de/azure/defender-for-cloud/azure-devops-extension)
Grundsätzen.

**Nichts für dich, wenn** dein Repository privat ist und du allen Beitragenden
vertraust. Das meiste, was hier gefunden wird, braucht einen Angreifer, der
einen Pull Request oder ein Issue aufmachen kann; ohne diese Angriffsfläche
bleiben die Funde theoretisch.

[![CI](https://github.com/9t29zhmwdh-coder/github-actions-security-sandbox/actions/workflows/ci.yml/badge.svg)](https://github.com/9t29zhmwdh-coder/github-actions-security-sandbox/actions) [![CodeQL](https://github.com/9t29zhmwdh-coder/github-actions-security-sandbox/actions/workflows/github-code-scanning/codeql/badge.svg)](https://github.com/9t29zhmwdh-coder/github-actions-security-sandbox/security/code-scanning) [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/9t29zhmwdh-coder/github-actions-security-sandbox/badge)](https://securityscorecards.dev/viewer/?uri=github.com/9t29zhmwdh-coder/github-actions-security-sandbox) [![OpenSSF Best Practices](https://www.bestpractices.dev/projects/13706/badge)](https://www.bestpractices.dev/projects/13706)

Expand Down
24 changes: 22 additions & 2 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,9 +5,29 @@

[🇩🇪 Deutsche Version](README.de.md)

**Static analysis and attack simulation for GitHub Actions workflows. Detects injection vectors, supply chain risks, excessive permissions and secret exposure. Generates prioritized findings with remediation guidance.**
**Reads your workflow files and points at the lines a stranger could use to steal your secrets.**

Aligned with [Microsoft Security DevOps](https://learn.microsoft.com/en-us/azure/defender-for-cloud/azure-devops-extension) principles. SARIF 2.1.0 output integrates natively with [GitHub Advanced Security (GHAS)](https://docs.github.com/en/get-started/learning-about-github/about-github-advanced-security) code scanning for enterprise security workflows.
A workflow is a shell script with your deployment credentials in scope, and
the ways it goes wrong do not look like bugs. `${{ github.event.issue.title }}`
inside a `run:` block is command execution by anyone who can open an issue.
`pull_request_target` on untrusted code hands the fork your secrets. An action
pinned to a tag is a promise its owner can break.

```
ghass scan .github/workflows what is exploitable, ranked
ghass scan --format sarif into GitHub Advanced Security
```

It reads the YAML and nothing else: it never contacts GitHub and never runs a
workflow. SARIF 2.1.0 output goes straight into [GitHub Advanced Security
(GHAS)](https://docs.github.com/en/get-started/learning-about-github/about-github-advanced-security)
code scanning. Aligned with [Microsoft Security
DevOps](https://learn.microsoft.com/en-us/azure/defender-for-cloud/azure-devops-extension)
principles.

**Not for you if** your repository is private and every contributor is
trusted. Most of what this finds needs an attacker who can open a pull request
or an issue, and without that surface the findings are theoretical.

[![CI](https://github.com/9t29zhmwdh-coder/github-actions-security-sandbox/actions/workflows/ci.yml/badge.svg)](https://github.com/9t29zhmwdh-coder/github-actions-security-sandbox/actions) [![CodeQL](https://github.com/9t29zhmwdh-coder/github-actions-security-sandbox/actions/workflows/github-code-scanning/codeql/badge.svg)](https://github.com/9t29zhmwdh-coder/github-actions-security-sandbox/security/code-scanning) [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/9t29zhmwdh-coder/github-actions-security-sandbox/badge)](https://securityscorecards.dev/viewer/?uri=github.com/9t29zhmwdh-coder/github-actions-security-sandbox) [![OpenSSF Best Practices](https://www.bestpractices.dev/projects/13706/badge)](https://www.bestpractices.dev/projects/13706)

Expand Down