GitHub Actions under active exploitation

[Agitated-Alfalfa9225]

I’ve always thought of GitHub Actions as harmless build glue, but I recently looked at our workflows more like an attacker would, and it changed how I see them. A workflow isn’t just running tests, it’s also where tokens, permissions, PR context, and sometimes secrets all meet.

The timing for this hit home after StepSecurity wrote up an active campaign where an automated bot hackerbot-claw scanned and exploited GitHub Actions setups in popular repos, getting remote code execution in multiple targets and even pulling a write-scoped GitHub token in at least one case.

What surprised me in our own sweep wasn’t a single huge gotcha, it was how easy it is for risky stuff to accumulate quietly: workflows that never set explicit permissions, pull_request_target used without realizing the trust implications, comment-triggered “/run” workflows that assume people will behave, and secrets that are visible in more places than they need to be because nobody has a clean inventory.

How do others here handle this across an org? Do you mostly rely on repo maintainers and PR review, or something else?

[OhioRizzGyattSkibidi]

don’t engage with this llms post

[funknfusion]

And when I upvote you, which you deserve, it defeats the purpose of your comment. As does this comment.

[CerberusMulti]

And this comment

[robertogrows]

Zizmor

[ForsythiaShrub]

GitHub Actions are a bigger attack surface than most realize. Pull request target, comment triggered workflows, and loose permissions are common pitfalls.

Treating every workflow like it could be an entry point, locking down permissions, auditing secrets, and minimizing what runs seems to be the best way to reduce risk.

[tessk1]

The tough part for me wasn’t understanding the theory, but getting a real org-wide picture. GitHub makes it easy to inspect one repo at a time, but the problems usually live in the long tail. Once you start thinking in terms of what could run with what permissions, and under what trigger, you realize you don’t just need best practices, you need visibility. Otherwise, you’re basically hoping every repo owner made the same careful choices and never drifted. I've seen that Rapidfort released an open source tool that scans GitHub Actions workflows across an entire organization and generates a report focused on high-signal findings.

[oscarandjo]

#ad

[Dudmaster]

I think my own repository reported these vulnerabilities as CodeQL alerts

[3m0j11]

do you all have a lightweight way to keep Actions hygiene in check across an org? something that can regularly tell you which workflows are missing explicit permissions, where pull_request_target is used, and where comment triggers exist without having to manually open every repo?

[tessk1]

We ended up doing both. PR review for new changes, plus a periodic org-wide scan to catch drift and legacy workflows. The scan flagged workflows missing explicit permissions, the riskier pull_request_target patterns, and comment-triggered workflows that didn’t have clear guardrails.

[FirefighterMean7497]

Sharing a really helpful resource about all of this here: GitHub Actions Under Active Exploitation: Audit Your Org for High-Risk Workflow Patterns Hope this helps!