Seguridad · plugin para JetBrains
GitHub Actions Pwn-Request Companion
GratisCI/CD Security
Flags a job that checks out untrusted PR/workflow_run head content while secrets are reachable: the real "Pwn Request" pattern.
La brecha que resuelve
GitHub Security Lab's own documented failure pattern ("Keeping your GitHub Actions and workflows secure: Preventing pwn requests"): a workflow triggered by pull_request_target/workflow_run is privileged (repository write access, secrets) by design, but if it also checks out the PR's own head content before any privileged step, an attacker's code runs with that privilege -- a practice GitHub Security Lab warns "may lead to repository compromise". zizmor covers workflow security as a CLI tool, not an IDE plugin; no dedicated Marketplace plugin found for this exact, cross-file reusable-workflow angle.
Datos y precio
- Categoría
- Seguridad
- Precio
- Gratis
- Plataforma
- IntelliJ-family
- Primera publicación
- —
- ID en Marketplace
- #34066
- Repositorio
github-actions-pwn-request-companion- Crecimiento
- ▲ +6600.0% desde el 2026-09-05 (1→67)
Plugins relacionados
Todos los plugins de seguridadLightweight, 100% local API-security checks for Java and Kotlin: hardcoded secrets, plaintext HTTP, TLS misconfiguration, and OWASP API Security Top 10 patterns.
Decode and verify JSON Web Tokens directly in a dedicated tool window: no browser round-trip, no data leaving the IDE.
A native, client-side viewer for X.509 certificates and keystores: decode a .pem, .crt, .cer, .der, .jks, .p12, or .pfx file without leaving the IDE.
Flags known-vulnerable dependency versions directly in pom.xml, build.gradle(.kts), package.json, and requirements.txt, matched against a vulnerability database bundled inside the plugin: zero account, zero token, zero network call, ever.
Descargas y estrellas al 2026-10-18, actualizadas dos veces al día desde las API de JetBrains Marketplace y GitHub.