llgoyal6/secret-blast-radiusv0.3.0Public
Secret blast radius
Answers one question about your CI, and it is not whether an outsider can get in: given the secrets a workflow already declares, how far does each one actually reach inside your own run? Where ci-supply-chain asks whether an outside contributor can reach your secrets and workflow-injection asks whether untrusted text
Read the full description
can become a command, this reads the reach of a secret you deliberately gave your own CI, because a CI secret is scoped by whoever wrote the YAML and the usual scope is everything. For every secret name a workflow mentions it reports the real reach - which jobs, how many steps, and which third-party actions can read it - and that per-secret reach table, not a list of rule hits, is the output. Ranked by reach rather than by rule: a secret sitting in the environment of a step that runs npm install, pip install, go mod download or npx is CRITICAL, because every postinstall and build backend in the tree is arbitrary code from hundreds of authors and it runs with that environment; a secret readable by
Before you run it11 local tools
Everything here is checked on your machine when rote inspects the play. This page never learns what you have installed or which credentials you hold.
- ○bashlocal tool
Must be on your PATH when used. minimum version undeclared.
- ○python3local tool
Requires >=3.8.0. Run rote play inspect to check your host; unverified versions remain unknown.
- ○findlocal tool
Must be on your PATH when used. minimum version undeclared.
- ○greplocal tool
Must be on your PATH when used. minimum version undeclared.
- ○sedlocal tool
Must be on your PATH when used. minimum version undeclared.
- ○sortlocal tool
Must be on your PATH when used. minimum version undeclared.
- ○wclocal tool
Must be on your PATH when used. minimum version undeclared.
- ○trlocal tool
Must be on your PATH when used. minimum version undeclared.
- ○catlocal tool
Must be on your PATH when used. minimum version undeclared.
- ○mktemplocal tool
Must be on your PATH when used. minimum version undeclared.
- ○rmlocal tool
Must be on your PATH when used. minimum version undeclared.
Inputs2, 1 required
rote asks for these before running and shows the defaults it will use.
- Root
rootDirectory tree whose GitHub Actions workflow files should be read for secret blast radius
requiredstringexample.custom value allowed - Depth
depthHow many directory levels below root to search for repositories holding a .github/workflows directory
optionalstringdefault4example3custom value allowed
What it changes
No write operations are declared in this version's manifest.
Credentials remain in the recipient's local rote vault; this page and the publisher never receive them.
Runtime details
- rote CLIversion 0.62.0 or newer
- Servicesnone declared
- Digest
sha256:c3822668b5c430298ef885009909187152430c0ff43111d4577fea9cfd88c9c2 - Archive size50954 bytes
- Published2026-09-04T04:47:44.290399+00:00
- Published withrote 0.79.0
Credential values and current readiness remain local. Opening this page never prompts for a credential, opens an authorization browser, or calls a service this play uses.
A play is a published, versioned automation package that runs on your own machine through rote, a free command-line tool. Opening this page installs nothing and runs nothing.