I Scanned 1,000 GitHub Actions Workflows — 40% Had Security Issues

Every time you push code to GitHub, your CI/CD pipeline runs with elevated permissions. But how many developers actually audit their GitHub Actions workflows for security? I analyzed 1,000 popular open-source repositories and found that 40% had at least one security issue in their workflow files. Here are the most common mistakes — and how to fix them. How I Found These Issues I wrote a script that clones the top 1,000 most-starred repositories on GitHub and scans their .github/workflows/ directory for common security anti-patterns. import requests import yaml import re def scan_workflow ( workflow_content ): issues = [] try : workflow = yaml . safe_load ( workflow_content ) except yaml . YAMLError : return issues if not workflow or ' jobs ' not in workflow : return issues for job_name , job in workflow . get ( ' jobs ' , {}). items (): for step in job . get ( ' steps ' , []): run_cmd = step . get ( ' run ' , '' ) uses = step . get ( ' uses ' , '' ) # Check for unpinned actions if uses