The gap it fixes

GitHub Security Lab's own documented failure pattern ("Keeping your GitHub Actions and workflows secure: Preventing pwn requests"): a workflow triggered by pull_request_target/workflow_run is privileged (repository write access, secrets) by design, but if it also checks out the PR's own head content before any privileged step, an attacker's code runs with that privilege -- a practice GitHub Security Lab warns "may lead to repository compromise". zizmor covers workflow security as a CLI tool, not an IDE plugin; no dedicated Marketplace plugin found for this exact, cross-file reusable-workflow angle.

Facts and pricing

Category: Security
Pricing: Free
Platform: IntelliJ-family
First published: —
Marketplace ID: #34066
Repository: github-actions-pwn-request-companion
Growth: ▲ +6600.0% since 2026-09-05 (1→67)

Related plugins

All Security plugins

Freemium

API Security Companion

API Security

Lightweight, 100% local API-security checks for Java and Kotlin: hardcoded secrets, plaintext HTTP, TLS misconfiguration, and OWASP API Security Top 10 patterns.

Decode and verify JSON Web Tokens directly in a dedicated tool window: no browser round-trip, no data leaving the IDE.

A native, client-side viewer for X.509 certificates and keystores: decode a .pem, .crt, .cer, .der, .jks, .p12, or .pfx file without leaving the IDE.

185 downloadsDetails

Free

Dependency Vulnerability Companion

Dependency / SCA Security

Flags known-vulnerable dependency versions directly in pom.xml, build.gradle(.kts), package.json, and requirements.txt, matched against a vulnerability database bundled inside the plugin: zero account, zero token, zero network call, ever.

171 downloadsDetails

Need a tool like this built for your codebase?Custom static-analysis rules, CI/CD integration, private plugin distribution and performance audits for IntelliJ plugins.

Work with Joel

Download and star counts as of 2026-10-18, refreshed twice daily from the JetBrains Marketplace and GitHub APIs.