{"slug": "zizmor", "name": "zizmor", "category": "security", "category_name": "Security and passwords", "description": "", "recommenders": 9, "commenters": 11, "warners": 1, "score": 7.24, "rising": -0.29, "first": "2025-12-08", "latest": "2026-09-16", "why": "zizmor is pointing out the exact weaknesses that were used", "why_is_quote": true, "has_verdict": false, "sentiment": {"recommend": 9, "neutral": 0, "compare": 1, "warn": 1}, "spark": [0, 1, 0, 0, 2, 1, 3, 0, 0, 2, 0, 0], "listed": true, "loved": [], "caveat": "", "short_quote": "zizmor is pointing out the exact weaknesses that were used", "kind": "", "icon": true, "domain": null, "github_repo": "github.com/zizmorcore/zizmor", "official_url": "https://docs.zizmor.sh", "pricing": "", "aliases": ["zizmor"], "verdict": null, "praise": [{"label": "", "summary": "", "quotes": [{"id": 789330576, "item_id": 49333161, "url": "https://news.ycombinator.com/item?id=49333161", "by": "inahga", "date": "2026-08-17", "stance": "recommend", "quote": "Use zizmor in CI", "excerpt": "I probably would have made the same mistake. It is negligent to write GitHub Actions without using static analysis. Use zizmor in CI https://github.com/zizmorcore/zizmor error[template-injection]: code injection via template expansion --> .github/workflows/jira_issue.yml:24:29 | 22 | run: | | --- this run block 23 | # Escape special characters in title and body 24 | TITLE=$(echo '${{ github.event.issue.title }}' | se", "context": "", "use_case": "static analysis of GitHub Actions", "switched_from": "", "story": "AI-Generated GitHub Copilot \"Autofix\" Allowed Compromise of Snowflake's Jira"}, {"id": 789321040, "item_id": 49332565, "url": "https://news.ycombinator.com/item?id=49332565", "by": "thejosh", "date": "2026-08-17", "stance": "recommend", "quote": "been a huge fan of zizmor", "excerpt": "also been a huge fan of zizmor (https://github.com/zizmorcore/zizmor) lately, basically: \"am I going to footgun myself?\"", "context": "", "use_case": "GitHub Actions security linting", "switched_from": "", "story": "AI-Generated GitHub Copilot \"Autofix\" Allowed Compromise of Snowflake's Jira"}, {"id": 771225888, "item_id": 48201618, "url": "https://news.ycombinator.com/item?id=48201618", "by": "vldszn", "date": "2026-05-19", "stance": "recommend", "quote": "Maybe zizmor could catch this", "excerpt": "Maybe zizmor could catch this https://github.com/zizmorcore/zizmor but not sure 100%", "context": "", "use_case": "GitHub Actions security scanning", "switched_from": "", "story": "GitHub is investigating unauthorized access to their internal repositories"}, {"id": 771224992, "item_id": 48201562, "url": "https://news.ycombinator.com/item?id=48201562", "by": "vldszn", "date": "2026-05-19", "stance": "recommend", "quote": "Use Static analysis for GHA to catch security issues", "excerpt": "harden your github actions! - Use Static analysis for GHA to catch security issues: https://github.com/zizmorcore/zizmor - set locally: pnpm config set minimum-release-age 4320 # 3 days in minutes https://pnpm.io/supply-chain-security for other package managers check: https://gist.github.com/mcollina/b294a6c39ee700d24073c0e5a4e93104 - add Socket Free Firewall when installing npm packages on CI https://docs.socket.dev", "context": "", "use_case": "GitHub Actions security scanning", "switched_from": "", "story": "GitHub is investigating unauthorized access to their internal repositories"}, {"id": 769755520, "item_id": 48109720, "url": "https://news.ycombinator.com/item?id=48109720", "by": "SEJeff", "date": "2026-05-12", "stance": "recommend", "quote": "Their action is also super handy", "excerpt": "Their action is also super handy: https://github.com/zizmorcore/zizmor-action Use pinact (you can brew install it) to pin it by checksum: https://github.com/suzuki-shunsuke/pinact", "context": "", "use_case": "GitHub Actions static analysis", "switched_from": "", "story": "Static Analysis for GitHub Actions"}]}], "caveats": [{"label": "", "summary": "", "quotes": [{"id": 795641363, "item_id": 49727585, "url": "https://news.ycombinator.com/item?id=49727585", "by": "paimapi", "date": "2026-09-16", "stance": "warn", "quote": "zizmor produces an overwhelming majority of false positives here", "excerpt": "I think the future of development will be a lot of automated quality checks like these on AI-drafted code that humans review and ensures that it doesn't muck up the business logic and actually fulfills the acceptance criteria. that said, I don't think existing toolsets are really great at actually measuring code quality I've been in the process of reviewing and validating a lot of tools like this (qlty, Sonarqube, fa", "context": "", "use_case": "GitHub Actions security checks", "switched_from": "", "story": "ImpactGate: A merge gate that scores the structural decay AI adds"}]}], "who": [], "tags": [], "use_cases": ["github actions security scanning", "github actions security linting", "github actions security checks", "static analysis of github actions", "github actions static analysis", "find workflow misconfigurations"], "compared": [{"slug": "github-actions", "name": "GitHub Actions", "co": 2, "switched_from": 0, "switched_to": 0}, {"slug": "trivy", "name": "Trivy", "co": 2, "switched_from": 0, "switched_to": 0}, {"slug": "pinact", "name": "pinact", "co": 2, "switched_from": 0, "switched_to": 0}], "makers": [{"id": 767042336, "item_id": 47940146, "url": "https://news.ycombinator.com/item?id=47940146", "by": "woodruffw", "date": "2026-04-28", "stance": "neutral", "quote": "Oh, I guess I didn't document it explicitly.", "excerpt": "Oh, I guess I didn't document it explicitly. My bad! You can see it in the source here[1]. [1]: https://github.com/zizmorcore/zizmor/blob/db5ed6b3bb445848a8e7b1920a12c9c664d08a33/crates/zizmor/src/audit/known_vulnerable_actions.rs#L84-L98", "context": "", "use_case": "Auditing GitHub Actions", "switched_from": "", "story": "GitHub Actions is the weakest link"}], "threads": [{"url": "https://news.ycombinator.com/item?id=47933257", "title": "GitHub Actions is the weakest link", "mentions": 3}, {"url": "https://news.ycombinator.com/item?id=49331423", "title": "AI-Generated GitHub Copilot \"Autofix\" Allowed Compromise of Snowflake's Jira", "mentions": 2}, {"url": "https://news.ycombinator.com/item?id=48201316", "title": "GitHub is investigating unauthorized access to their internal repositories", "mentions": 2}, {"url": "https://news.ycombinator.com/item?id=49726329", "title": "ImpactGate: A merge gate that scores the structural decay AI adds", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=48109713", "title": "Static Analysis for GitHub Actions", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=48100706", "title": "TanStack NPM Packages Compromised", "mentions": 1}], "sentiment_by_month": {"2025-11": {}, "2025-12": {"recommend": 1}, "2026-01": {}, "2026-02": {}, "2026-03": {"recommend": 2}, "2026-04": {"compare": 1, "recommend": 1}, "2026-05": {"recommend": 3}, "2026-06": {}, "2026-07": {}, "2026-08": {"recommend": 2}, "2026-09": {"warn": 1}, "2026-10": {}}, "quotes": [{"id": 795641363, "item_id": 49727585, "url": "https://news.ycombinator.com/item?id=49727585", "by": "paimapi", "date": "2026-09-16", "stance": "warn", "quote": "zizmor produces an overwhelming majority of false positives here", "excerpt": "I think the future of development will be a lot of automated quality checks like these on AI-drafted code that humans review and ensures that it doesn't muck up the business logic and actually fulfills the acceptance criteria. that said, I don't think existing toolsets are really great at actually measuring code quality I've been in the process of reviewing and validating a lot of tools like this (qlty, Sonarqube, fa", "context": "", "use_case": "GitHub Actions security checks", "switched_from": "", "story": "ImpactGate: A merge gate that scores the structural decay AI adds"}, {"id": 789330576, "item_id": 49333161, "url": "https://news.ycombinator.com/item?id=49333161", "by": "inahga", "date": "2026-08-17", "stance": "recommend", "quote": "Use zizmor in CI", "excerpt": "I probably would have made the same mistake. It is negligent to write GitHub Actions without using static analysis. Use zizmor in CI https://github.com/zizmorcore/zizmor error[template-injection]: code injection via template expansion --> .github/workflows/jira_issue.yml:24:29 | 22 | run: | | --- this run block 23 | # Escape special characters in title and body 24 | TITLE=$(echo '${{ github.event.issue.title }}' | se", "context": "", "use_case": "static analysis of GitHub Actions", "switched_from": "", "story": "AI-Generated GitHub Copilot \"Autofix\" Allowed Compromise of Snowflake's Jira"}, {"id": 789321040, "item_id": 49332565, "url": "https://news.ycombinator.com/item?id=49332565", "by": "thejosh", "date": "2026-08-17", "stance": "recommend", "quote": "been a huge fan of zizmor", "excerpt": "also been a huge fan of zizmor (https://github.com/zizmorcore/zizmor) lately, basically: \"am I going to footgun myself?\"", "context": "", "use_case": "GitHub Actions security linting", "switched_from": "", "story": "AI-Generated GitHub Copilot \"Autofix\" Allowed Compromise of Snowflake's Jira"}, {"id": 771225888, "item_id": 48201618, "url": "https://news.ycombinator.com/item?id=48201618", "by": "vldszn", "date": "2026-05-19", "stance": "recommend", "quote": "Maybe zizmor could catch this", "excerpt": "Maybe zizmor could catch this https://github.com/zizmorcore/zizmor but not sure 100%", "context": "", "use_case": "GitHub Actions security scanning", "switched_from": "", "story": "GitHub is investigating unauthorized access to their internal repositories"}, {"id": 771224992, "item_id": 48201562, "url": "https://news.ycombinator.com/item?id=48201562", "by": "vldszn", "date": "2026-05-19", "stance": "recommend", "quote": "Use Static analysis for GHA to catch security issues", "excerpt": "harden your github actions! - Use Static analysis for GHA to catch security issues: https://github.com/zizmorcore/zizmor - set locally: pnpm config set minimum-release-age 4320 # 3 days in minutes https://pnpm.io/supply-chain-security for other package managers check: https://gist.github.com/mcollina/b294a6c39ee700d24073c0e5a4e93104 - add Socket Free Firewall when installing npm packages on CI https://docs.socket.dev", "context": "", "use_case": "GitHub Actions security scanning", "switched_from": "", "story": "GitHub is investigating unauthorized access to their internal repositories"}, {"id": 769755520, "item_id": 48109720, "url": "https://news.ycombinator.com/item?id=48109720", "by": "SEJeff", "date": "2026-05-12", "stance": "recommend", "quote": "Their action is also super handy", "excerpt": "Their action is also super handy: https://github.com/zizmorcore/zizmor-action Use pinact (you can brew install it) to pin it by checksum: https://github.com/suzuki-shunsuke/pinact", "context": "", "use_case": "GitHub Actions static analysis", "switched_from": "", "story": "Static Analysis for GitHub Actions"}, {"id": 769722144, "item_id": 48107634, "url": "https://news.ycombinator.com/item?id=48107634", "by": "lknuth", "date": "2026-05-12", "stance": "recommend", "quote": "Static analyzers like https://github.com/zizmorcore/zizmor can help find such misconfiguration.", "excerpt": "Static analyzers like https://github.com/zizmorcore/zizmor can help find such misconfiguration. It is however unfortunate, that such footguns aren't harder to fire.", "context": "", "use_case": "find workflow misconfigurations", "switched_from": "", "story": "TanStack NPM Packages Compromised"}, {"id": 767156816, "item_id": 47947301, "url": "https://news.ycombinator.com/item?id=47947301", "by": "datosh", "date": "2026-04-29", "stance": "recommend", "quote": "zizmor is pointing out the exact weaknesses that were used", "excerpt": "In the light of recent supply chain attacks I have conducted a scan of the top 10k repos (by stars) using the GHA security scanner zizmor. The results are quite sobering. Many of the recent supply chain attacks were preventable, since zizmor is pointing out the exact weaknesses that were used: unpinned dependencies, template injection, ... and many more. Happy for any input and feedback on the data and presentation, ", "context": "", "use_case": "GitHub Actions security scanning", "switched_from": "", "story": "96% of GitHub repos have high severity issues in their Action workflows"}, {"id": 767039456, "item_id": 47939966, "url": "https://news.ycombinator.com/item?id=47939966", "by": "woodruffw", "date": "2026-04-28", "stance": "recommend", "quote": "zizmor (and other tools) correctly recovers vulnerability information for SHA-pinned actions", "excerpt": "You lose vulnerability alerts, on GitHub. This is a (ridiculous, IMO) platform limitation that GitHub could lift by applying more engineering time to Dependabot and Dependabot's integrated security alerts feature. zizmor (and other tools) correctly recovers vulnerability information for SHA-pinned actions[1]. [1]: https://docs.zizmor.sh/audits/#known-vulnerable-actions", "context": "", "use_case": "Scanning GitHub Actions for vulnerabilities", "switched_from": "", "story": "GitHub Actions is the weakest link"}, {"id": 767005489, "item_id": 47937843, "url": "https://news.ycombinator.com/item?id=47937843", "by": "electricapps", "date": "2026-04-28", "stance": "compare", "quote": "Linter like zizmor are great, but they struggle with deep composite actions trees", "excerpt": "Great writeup. Though combined with the lack of lockfiles for transitive actions, relying purely on static analysis is tough. Linter like zizmor are great, but they struggle with deep composite actions trees and runtime template injection. I got frustrated with the lack of security to started working myself on an open-source runtime sandbox for GHA: https://github.com/electricapp/hasp The first check was inspired by ", "context": "", "use_case": "", "switched_from": "", "story": "GitHub Actions is the weakest link"}, {"id": 760163553, "item_id": 47510222, "url": "https://news.ycombinator.com/item?id=47510222", "by": "jimmySixDOF", "date": "2026-03-24", "stance": "recommend", "quote": "zizmor is probably better than starting with an LLM", "excerpt": "Not sure that Trivy was doing that itself but zizmor is probably better than starting with an LLM : https://github.com/zizmorcore/zizmor", "context": "", "use_case": "", "switched_from": "", "story": "LiteLLM Python package compromised by supply-chain attack"}, {"id": 759837554, "item_id": 47489847, "url": "https://news.ycombinator.com/item?id=47489847", "by": "woodruffw", "date": "2026-03-23", "stance": "compare", "quote": "zizmor's unpinned-uses[3]", "excerpt": "See also pinact[1], gha-update[2], and zizmor's unpinned-uses[3]. The main desiderata with these kinds of action pinning tools is that they (1) leave a tag comment, (2) leave that comment in a format that Dependabot and/or Renovate understands for bumping purposes, and (3) actually put the full tag in the comment, rather than the cutesy short tag that GitHub encourages people to make mutable (v4.x.y instead of v4). [", "context": "", "use_case": "", "switched_from": "", "story": "GitHub appears to be struggling with measly three nines availability"}, {"id": 756376800, "item_id": 47273550, "url": "https://news.ycombinator.com/item?id=47273550", "by": "whopdrizzard", "date": "2026-03-06", "stance": "recommend", "quote": "zizmor detects quite a few typical injection patterns", "excerpt": "zizmor (https://github.com/zizmorcore/zizmor) and actionlint (runs shellcheck on run: | blocks) provide some bandaid. zizmor detects quite a few typical injection patterns like branch names and shellcheck enforces quoeting rules in the shell snippets", "context": "", "use_case": "GitHub Actions security linting", "switched_from": "", "story": "A GitHub Issue Title Compromised 4k Developer Machines"}, {"id": 739055472, "item_id": 46190967, "url": "https://news.ycombinator.com/item?id=46190967", "by": "ignoramous", "date": "2025-12-08", "stance": "recommend", "quote": "zizmor is excellent at scanning workflows and finding security issues.", "excerpt": "> Some teams vendor actions into their own repos. zizmor is excellent at scanning workflows and finding security issues. But these are workarounds for a system that lacks the basics. Harsh given GitHub makes it very easy to setup attestations for Artifact (like build & sbom) provenances. That said, Zizmor (static analyser for GitHub Actions) with Step Security's Harden Runner (a runtime analyser) [0] pair nicely, eve", "context": "", "use_case": "GitHub Actions security scanning", "switched_from": "", "story": "GitHub Actions has a package manager, and it might be the worst"}]}