vlotpipe

Catch injection, credential, and supply-chain mistakes in your pipelines before they run:

• An action pinned to a movable tag instead of a commit SHA, leading to silent supply-chain compromise if that tag ever gets repointed.
• Untrusted PR code checked out inside a privileged trigger, leading to arbitrary code execution with your repo's secrets and write access.
• Attacker-controlled input interpolated straight into a shell script, leading to arbitrary command execution via string injection — no checkout required.
• A credential hardcoded into workflow YAML, leading to permanent leakage in git history.
• No permissions: block, or secrets: inherit on a reusable workflow call, leading to an over-privileged runner.

See it work

$ vlotpipe scan .
.github/workflows/ci.yml:9:15: YAML005 "yes" is an unquoted YAML boolean-like value; quote it if a literal string was intended, or use true/false if a boolean was intended
.github/workflows/ci.yml:11:9: SEC001 action "actions/checkout" is pinned to "v4", not a full commit SHA
.github/workflows/ci.yml:13:9: SEC002 "api_key" looks like a hardcoded credential; use secrets.API_KEY instead
.github/workflows/ci.yml:20:5: TIMEOUT001 job 'build' has no timeout-minutes; defaults to GitHub's 360-minute cap

Found 4 violations across 1 file (2 blockers, 1 warning, 1 info)

Tested against

Before shipping a rule, it gets run against a real, actively-maintained pipeline and every finding — and every absence of a finding — gets verified against the actual source.

Every confirmed bug found and fixed along the way →

Install

go build -o vlotpipe ./cmd/vlotpipe

go install and tagged binary releases land once the first version is tagged — see the Status section for where that stands.