Uploaded December 2025 | Updated September 2026, 3 weeks ago
Github Actions is increasingly becoming a popular tool for organizations to run CI and other automation tasks, and understandably so: they’re easy to use, composable, and have tons of available integrations. Like with any technology though, they come with security risks that can be easily overlooked, even with code review.
However, we won't be focusing on Github Actions security -- there's enough material out there. Instead, we'll focus on what makes it a great target for static analysis. We'll walk through the principles that make static analysis tools great, apply them to Github Actions, and talk about how you can apply these principles to any security tools you build.
OMAR
Betterment
Staff Security Engineer
Omar is a Staff Security Engineer at Betterment where he focuses on building secure and reliable systems, stopping fraudsters, and in general enabling people to do their best work safely and securely. He has a 12 year old cat named Dumpling.
linkedin.com/in/omarthecat
github.com/ancat (blog)
betterment.com (company)
Managed by the OWASP® Foundation
owasp.org
Github Actions is increasingly becoming a popular tool for organizations to run CI and other automation tasks, and understandably so: they’re easy to use, composable, and have tons of available integrations. Like with any technology though, they come with security risks that can be easily overlooked, even with code review.
However, we won't be focusing on Github Actions security -- there's enough material out there. Instead, we'll focus on what makes it a great target for static analysis. We'll walk through the principles that make static analysis tools great, apply them to Github Actions, and talk about how you can apply these principles to any security tools you build.
OMAR
Betterment
Staff Security Engineer
Omar is a Staff Security Engineer at Betterment where he focuses on building secure and reliable systems, stopping fraudsters, and in general enabling people to do their best work safely and securely. He has a 12 year old cat named Dumpling.
linkedin.com/in/omarthecat
github.com/ancat (blog)
betterment.com (company)
Managed by the OWASP® Foundation
owasp.org
