A static analysis tool that scans Go source code for common security vulnerabilities and insecure coding patterns.
9K+7 this week731GoApache-2.0Well maintainedUpdated 4 days ago
zizmorcore/zizmor
A static analysis tool that finds and fixes security issues in CI/CD configurations such as GitHub Actions, Dependabot and pre-commit.
- Stars
- 6,931
- Forks
- 280
- Open issues
- 171
- Last commit
- 13 hours ago
What is it?
zizmor is a static analysis tool for CI/CD systems. It scans workflow and configuration files for security problems in common setups, with GitHub Actions, Dependabot and pre-commit among the supported targets.
It looks for issues such as template injection that can lead to attacker-controlled code execution, accidental credential persistence and leakage, excessive permission scopes granted to runners, and impostor commits or confusable git references. The project also offers suggested fixes for many findings, and its audit rules are documented on its website.
zizmor is written in Rust and released under the MIT license. It is installed as a command-line tool and is intended to run locally or in CI pipelines.
Key features
- 01Detects template injection that can lead to attacker-controlled code execution.
- 02Finds accidental credential persistence and leakage in workflows.
- 03Flags excessive permission scopes granted to runners.
- 04Identifies impostor commits and confusable git references.
- 05Works with GitHub Actions, Dependabot and pre-commit configurations.
Use cases
- Auditing GitHub Actions workflows for security issues before merging changes.
- Adding a static security check to CI pipelines that build and deploy software.
- Reviewing repository permission settings and credential handling in automation.
Quick start
- 1
Follow the installation steps in the zizmor documentation
In collections
Topics
FAQ
- What is zizmor?
- A static analysis tool that finds and fixes security issues in CI/CD configurations such as GitHub Actions, Dependabot and pre-commit. zizmor is a static analysis tool for CI/CD systems. It scans workflow and configuration files for security problems in common setups, with GitHub Actions, Dependabot and pre-commit among the supported targets.
- Is zizmor free to use? What license does it have?
- zizmor is open source under the MIT license. Check the license terms before using it in commercial products.
- Is zizmor still maintained?
- Actively maintained. The last commit to zizmor was on Nov 7, 2026.
- What can I use zizmor for?
- Auditing GitHub Actions workflows for security issues before merging changes. Adding a static security check to CI pipelines that build and deploy software. Reviewing repository permission settings and credential handling in automation.
- How do I install zizmor?
- Follow the installation steps in the zizmor documentation
- Where can I get zizmor?
- The source code and installation instructions are on GitHub: https://github.com/zizmorcore/zizmor
Summary generated by AI from the project's README. GitHub stats refresh daily.
Related projects
A Rust-based secret scanner that detects leaked credentials, validates which are live, maps their access, and supports revocation.
1.3K+7 this week125RustApache-2.0Updated 2 days ago
A CLI tool for detecting hardcoded secrets such as passwords, API keys and tokens in git repos, files and stdin.
30.8K+212 this week2.3KGoMITUpdated 11 days ago
CLI that detects and validates 500+ types of hardcoded secrets in files, git repos, Docker images and packages, usable as a pre-commit hook or in CI.
2K+1 this week221PythonMITUpdated yesterday
A fast, configurable secrets scanner that finds leaked credentials in git repos, files, GitHub, GitLab, S3 and more.
2.9K+127 this week184GoMITUpdated yesterday
AI-first security scanner for code and AI agent configs, with built-in rules for LLM apps, MCP servers, and secrets leaked in chat or shell history.
1K+2 this week155PythonAGPL-3.0Updated 3 months ago