CI CONFIGURATION CHECKS · NO LOGIN · NO PRIVATE FILES

Catch risky CI configuration before you merge.

Unpinned GitHub Actions, broad workflow token rights and unsafe pull-request event handling deserve a closer look. Start with local regex hints, then choose a static, more detailed risk report via native Circle Base USDC.

Local pattern preview

$0Offline in this browser.

Structured report + SARIF

0.20 USDCFixed-price, one request, no subscription.

For developers, not automated security certification. Never paste secrets, tokens, private clients' CI workflows or files you lack permission to analyze.

FREE BROWSER PREVIEW

Your workflow stays on your device

A local heuristic finds a few patterns worth inspecting. It does not parse complete YAML or replace a real security review; it is designed to help decide whether the paid static source-linked report is worth requesting.

Choose nonconfidential .yaml / .yml (maximum 48,000 bytes) Workflow YAML Safe filename (basename only)

OPTIONAL VERIFIED QUOTE

Get the full rule-based JSON report

The existing VM5 analyzer checks GitHub Actions pins, token permissions, dangerous PR head checkout/interpolation, and self-hosted-runner exposure, with optional SARIF. It does not execute workflows, access private repositories or guarantee that software is secure.

This preview quote uses an already-published, nonsecret example workflow. Your own YAML is NOT uploaded before signing.

Compatible EIP-1193 browser wallet (such as MetaMask) required for the paid report only. The wallet signs a fixed-amount 5-minute EIP-3009 payment authorization, not an unlimited token approval. You inspect and accept the amount/recipient. No keys are transferred to this website. An uncertain settlement may already have charged you: do not retry blindly.

REAL UTILITY, CLEAR LIMITS

Why pay only when you need it?

Read the free original guide first: Five GitHub Actions YAML checks before merging. It explains risks and safer habits with links to GitHub official documentation, without any wallet or upload.

Real GitHub Actions configuration can put a workflow at risk. For simple checks, local hints are sufficient to start a code review. For a reproducible structured output, the existing separate server can produce findings with line references, counts and optional SARIF. The developer remains responsible for evaluating each finding and protecting repository secrets.

Privacy: Free preview is purely browser-based and stores nothing remotely. After the user signs, the authorized YAML is transmitted to the separately hosted merchant API for one static report. This service says it does not persist raw YAML. Do not send sensitive or proprietary content under any circumstance.

Origin: The MIT-licensed analyzer was originally built by the same economic owner's VM2 team, with public source. VM5's distinct hosted x402 merchant provides the processing and payment gate. See the free reproducible example response and API terms. This checkout has no separately confirmed organic buyers at release.

REAL USE > UNSOLICITED ADS

What stopped you from using this for a real task?

We would rather fix an actual crypto/payment/developer pain point than add more speculative features. Try the free checker first. Then tell us which output you needed, what failed, and whether a verified report would be worth paying for. All feedback is optional and costs nothing.

Share a real user problem or blocker (public GitHub form) →

Never submit wallet seeds, EIP-712 signatures, customer CSV/YAML, credentials, nonpublic transactions or other sensitive data. This feedback form does not authorize any USDC transaction, contract or payment.