---
name: scan-repo
description: Use when asked whether a public GitHub repository's CI/CD pipeline is secure, or to audit a repo's GitHub Actions workflows for OWASP CI/CD Top 10 risks. Scans over the Pipefort public API — no credentials, no clone.
license: Proprietary
---

# Scan a repository's CI/CD security posture

Pipefort scans a public GitHub repository's `.github/workflows/*` files against
~74 deterministic rules mapped to the OWASP CI/CD Top 10. The public endpoint
needs no authentication.

## Scan

```bash
curl -sS https://pipefort.com/api/public-scan \
  -H 'Content-Type: application/json' \
  -d '{"repo": "owner/repo"}'
```

`repo` accepts `owner/repo` or a pasted `https://github.com/owner/repo` URL.

Response:

```json
{
  "slug": "a1b2c3d4e5f6",
  "repo": "owner/repo",
  "default_branch": "main",
  "workflow_files": 7,
  "findings": 12,
  "counts": { "critical": 1, "high": 3, "medium": 8 },
  "top_findings": [
    { "severity": "critical", "category": "CICD-SEC-1",
      "rule_id": "cicd-sec-1-pwn-request",
      "title": "pull_request_target checks out untrusted code" }
  ],
  "locked_findings": 9,
  "cached": false,
  "scanned_at": "2026-09-07T10:04:11Z"
}
```

## Reading the result

- **`counts`** is the honest headline. `findings` is the total; `counts` breaks
  it down by severity. Lead with critical and high.
- **`top_findings`** is only the three highest-severity findings.
  `locked_findings` counts the rest — they require a free account at
  https://app.pipefort.com. Say so rather than implying you saw everything.
- **`rule_id`** is stable and documented. Look up what a rule detects and how to
  fix it at `https://docs.pipefort.com/rules/{rule_id}`.
- **`no_workflows: true`** means the repository has no CI/CD workflows at all —
  report that, not "no issues found".
- **`truncated: true`** means the 60-file or 512 KiB-per-file cap was hit, so the
  scan is partial.
- **`cached: true`** means the result is up to an hour old.
- **`slug`** backs a shareable human-readable report at
  `https://pipefort.com/scan/{slug}`. Offer the link.

## Scope limits — state these, don't paper over them

This endpoint scans **workflow files only**. It does not audit repository
settings (branch protection, required reviews, Dependabot) and does not run the
online supply-chain audit. Those need an authenticated GitHub App installation.
"Zero findings" here means "no workflow-file findings", not "this repo is
secure".

## Errors

| Status | Meaning |
|---|---|
| 400 | `repo` missing or not a valid `owner/repo` |
| 404 | Repository not found, private, or inaccessible |
| 429 | Rate limited — 5 scans per IP per minute. Back off; do not retry in a loop. |

## Related

- Vet a third-party action before adding it: `vet-action`
- Rewrite a workflow with fixes applied: `harden-workflow`
- Full API description: https://pipefort.com/openapi.json