Guides
How to harden workflow permissions
Every workflow runs with write access it does not need.
4 min read
Every workflow runs with write access it does not need.
Why it happens
The repository default grants broad GITHUB_TOKEN scopes unless explicitly narrowed.
How to fix it
- Set the organisation default to read-only
- Add a permissions block per job granting only what that job needs
- Audit workflows using pull_request_target — it is the highest-risk trigger
Your next build could be twice as fast, at half the price
Start free. Migrating away is the same one line, and we publish that diff too.
Related
How to manage secrets in GitHub ActionsSecrets are sprawled across repository settings and nobody knows what is still used.How to run CI runners inside your VPCBuilds need to reach an internal service that is not exposed publicly.How to give runners a static IPA third-party service requires IP allowlisting and hosted runner IPs change constantly.How to run security scans without slowing CIVulnerability scanning adds minutes to every pull request.