octoscan

Octoscan is a static vulnerability scanner designed for GitHub action workflows, enabling users to identify potential security issues within their CI/CD pipelines. Its primary use case is analyzing workflows for various vulnerabilities, including dangerous actions, credentials exposure, and expression injection. Notable features include the ability to download workflows from remote repositories, customizable rule sets for scanning, and support for multiple output formats, ensuring flexibility in vulnerability reporting.