CI/CD workflow security linter
Scan a GitHub Actions or GitLab CI file for the pipeline failures that get exploited — script injection from pull request titles, unpinned actions, and pull_request_target building fork code.
The check worth knowing about is script injection: GitHub substitutes ${{ ... }} into your shell script before the shell runs it, so an expression carrying a pull request title or branch name is not a variable — it is source code written by whoever opened the PR. Passing the value through env: and quoting it makes it data again. This reads one file; it cannot see your branch protection, environment approvals or runner configuration, so a clean result is not an audit. Runs in your browser.
Other tools
- EDI viewer & validator (X12 + EDIFACT)
- X.509 certificate decoder
- JSON ↔ XML converter
- CSV ↔ JSON converter
- OpenAPI linter
- MCP tool-definition linter
- OpenAPI → agent tools
- Agent blast-radius calculator
- Prompt secret scanner
- Agent cost & context calculator
- Agent-readiness scorecard
- iPaaS readiness assessment
- Modernisation roadmap generator
- Migration risk register
- Cutover runbook builder
- Interface catalogue builder
- Migration wave planner
- Function Point estimator
- Platform migration assessor
- Fixed-width flat file parser
- webMethods flow reader
- SAP IDoc viewer
- SWIFT MT & ISO 20022 viewer
- HL7 v2 message viewer
- XSLT tester
- XPath tester
- Regex tester & ReDoS checker
- Webhook signature verifier
- SLA & error budget calculator
- Retry & backoff simulator
- JSONPath tester
- JSON Schema generator
- Encoding & mojibake fixer
- JSON formatter & validator
- JSON diff
- Epoch & timestamp converter
- Base64 encoder & decoder
- UUID & ULID generator
- JWT decoder
- Cron expression explainer
- Interface math calculator
- Post-quantum migration matrix
- Post-quantum exposure calculator
These exist because the underlying problem is real. If the numbers you just put in look uncomfortable, that is usually worth a conversation.