A menagerie of insecure and exploitable GitHub Actions workflows and action definitions.
This repository contains a sampling of various known insecure or exploitable GitHub Actions usages. Each is (generally) isolated to its own workflow and/or action definition.
To protect the innocent, this repository does not have any actions enabled.
gha-hazmat is licensed under the terms of the MIT License.
Some workflow and action examples are adapted from public examples online; each is attributed where possible.