Applying the principle of least privilege is a security best practice. We've published a set of GitHub Actions that allow you to monitor and enumerate the set of privileges that are required by a given GitHub workflow. See it in action. github.blog/2023-06-26-new…

@github Check out app.stepsecurity.io to orchestrate GitHub Actions security. It fixes token permissions and more issues. Used by over 500 open source projects.

@github Certainly a nice feature, though a much better integration could help with reducing the number of steps for the analysis, any plans for being commit-free based?

@github That really effective code 🔥

@github @annejanbrouwer cool

@github Commit directly to the main branch 😭