ACTIONS PERMISSIONS CHECK · RUNS IN YOUR BROWSER

Does your GITHUB_TOKEN use least-privilege permissions?

A workflow or job with no permissions: block runs with whatever your repository or organization's default token permissions are — which can be read-write on every scope. Paste your workflow YAML below and this page finds every workflow and job that leaves that unspecified, or that grants permissions: write-all outright.

Nothing is uploaded. The YAML you paste is read in this browser and never leaves your device, and this tool makes no network calls of its own.

1. Paste one or more workflow files

Copy the contents of each file under .github/workflows/ you want checked. Add more blocks for more files — nothing here reads your repository, so pasting is how it sees anything.

Paste at least one workflow file above and click Check.

Prefer a CLI, or want this in your own CI?

Same logic, zero dependencies, one file:

python3 check.py                  # scan .github/workflows under the current directory
python3 check.py /path/to/repo    # scan a specific checkout
python3 check.py --format json    # machine-readable
python3 check.py --fail-on-risk   # exit 2 if any write-all or unspecified grant is found

Get check.py from the repo — stdlib only, nothing to install, no network calls. Wire --fail-on-risk into your own CI to block a newly-added unspecified or write-all workflow before it merges.

Common questions

Why does a missing permissions: block matter?

A workflow or job with no permissions: key runs with whatever your repository or organization's default GITHUB_TOKEN permissions are set to. Many repositories still default to read-write on every scope — it was GitHub's own default for repositories created before 2023-02-02. A workflow triggered by something an outside contributor can influence then runs with a token that can push commits or modify repository settings, even if the job only needed to read the checkout.

What is permissions: write-all and why is it risky?

write-all explicitly grants every scope write access, which is broader than almost any job actually needs. It replaces an ambient, hidden default with an explicit, but still overly broad, grant.

Does this tool know my repository's actual default token permissions?

No. There is no public API for that setting, and this tool makes no network calls of any kind. An unspecified finding means the workflow file itself does not make the permissions explicit — it does not mean your repository is definitely misconfigured, only that this file does not say.

Does a clean scan mean my workflow is secure?

No. This checks one specific, well-documented thing: whether a permissions block exists and is not write-all. It does not judge whether the scopes a workflow does declare are the minimum a job actually needs, and it makes no claim about your repository's overall security or compliance posture.

What should I put in a permissions: block?

GitHub's own guidance is to start from contents: read at the workflow level and add only the specific scope a job needs, such as pull-requests: write for a job that comments on PRs. This tool does not decide that for you — it only tells you where nothing has been decided yet.

More: how to set least-privilege permissions for GitHub Actions. See also how this compares to OpenSSF Scorecard's Token-Permissions check and this checker vs. reading the workflow YAML by hand.

Want all ten workflow risks in one run? Workflow Audit is a single GitHub Action that checks them together.