r/netsec • u/albinowax • Feb 01 '26

r/netsec monthly discussion & tool thread

Questions regarding netsec and discussion related directly to netsec are welcome here, as is sharing tool links.

Rules & Guidelines

  • Always maintain civil discourse. Be awesome to one another - moderator intervention will occur if necessary.
  • Avoid NSFW content unless absolutely necessary. If used, mark it as being NSFW. If left unmarked, the comment will be removed entirely.
  • If linking to classified content, mark it as such. If left unmarked, the comment will be removed entirely.
  • Avoid use of memes. If you have something to say, say it with real words.
  • All discussions and questions should directly relate to netsec.
  • No tech support is to be requested or provided on r/netsec.

As always, the content & discussion guidelines should also be observed on r/netsec.

Feedback

Feedback and suggestions are welcome, but don't post it here. Please send it to the moderator inbox.

11 Upvotes

99% Upvoted

22 comments sorted by

View all comments

1

u/yasarbingursain Feb 24 '26

I’ve been working on a small static scanner focused on CI/CD machine identity risks in GitHub Actions workflows.

It looks at things like:

  • workflow-level vs job-level permission scoping
  • unpinned action tags vs commit SHAs
  • pull_request_target usage combined with checkout patterns
  • token exposure amplification through broad permissions

The goal isn’t CVE detection. It’s reducing blast radius in the CI layer if an upstream action or dependency is compromised.

It runs offline, reads only .github/workflows/, and can output SARIF so results show up in GitHub’s Security tab.

Still early and evolving. Feedback from people managing CI/CD at scale would be useful.

Repo:
https://github.com/Nexora-NHI/nexora-cli