How to secure GitHub Actions workflows: 4 tips to handle untrusted input and tighten permissions

AI & ML
- AI & ML
  Learn about artificial intelligence and machine learning across the GitHub ecosystem and the wider industry.
  Generative AI
  Learn how to build with generative AI.
  GitHub Copilot
  Change how you work with GitHub Copilot.
  LLMs
  Everything developers need to know about LLMs.
  Machine learning
  Machine learning tips, tricks, and best practices.
  How AI code generation works
  Explore the capabilities and benefits of AI code generation and how it can improve your developer experience.
  Learn more
Developer skills
- Developer skills
  Resources for developers to grow in their skills and careers.
  Application development
  Insights and best practices for building apps.
  Career growth
  Tips & tricks to grow as a professional developer.
  GitHub
  Improve how you use GitHub at work.
  GitHub Education
  Learn how to move into your first professional role.
  Programming languages & frameworks
  Stay current on what’s new (or new again).
  Get started with GitHub documentation
  Learn how to start building, shipping, and maintaining software with GitHub.
  Learn more
Engineering
- Engineering
  Get an inside look at how we’re building the home for all developers.
  Architecture & optimization
  Discover how we deliver a performant and highly available experience across the GitHub platform.
  Engineering principles
  Explore best practices for building software at scale with a majority remote team.
  Infrastructure
  Get a glimpse at the technology underlying the world’s leading AI-powered developer platform.
  Platform security
  Learn how we build security into everything we do across the developer lifecycle.
  User experience
  Find out what goes into making GitHub the home for all developers.
  How we use GitHub to be more productive, collaborative, and secure
  Our engineering and security teams do some incredible work. Let’s take a look at how we use GitHub to be more productive, build collaboratively, and shift security left.
  Learn more
Enterprise software
- Enterprise software
  Explore how to write, build, and deploy enterprise software at scale.
  Automation
  Automating your way to faster and more secure ships.
  CI/CD
  Guides on continuous integration and delivery.
  Collaboration
  Tips, tools, and tricks to improve developer collaboration.
  DevOps
  DevOps resources for enterprise engineering teams.
  DevSecOps
  How to integrate security into the SDLC.
  Governance & compliance
  Ensuring your builds stay clean.
  Secure software development
  GitHub recognized as a Leader in the Gartner® Magic Quadrant™ for AI Code Assistants
  Learn why Gartner positioned GitHub as a Leader for the second year in a row.
  Learn more
News & insights
- News & insights
  Keep up with what’s new and notable from inside GitHub.
  Company news
  An inside look at news and product updates from GitHub.
  Octoverse
  Insights into the state of open source on GitHub.
  Policy
  The latest policy and regulatory changes in software.
  Product
  The latest on GitHub’s platform, products, and tools.
  Research
  Data-driven insights around the developer ecosystem.
  The library
  Older news and updates from GitHub.
  Unlocking the power of unstructured data with RAG
  Learn how to use retrieval-augmented generation (RAG) to capture more insights.
  Learn more
Open Source
- Open Source
  Everything open source on GitHub.
  Gaming
  Explore open source games on GitHub.
  Git
  The latest Git updates.
  Maintainers
  Spotlighting open source maintainers.
  Social impact
  How open source is driving positive change.
  An introduction to innersource
  Organizations worldwide are incorporating open source methodologies into the way they build and ship their own software.
  Learn more
Security
- Security
  Stay up to date on everything security.
  Application security
  Application security, explained.
  Supply chain security
  Demystifying supply chain security.
  Vulnerability research
  Updates from the GitHub Security Lab.
  Web application security
  Helpful tips on securing web applications.
  The enterprise guide to AI-powered DevSecOps
  Learn about core challenges in DevSecOps, and how you can start addressing them with AI and automation.
  Learn more

Explore more from GitHub

Docs
Everything you need to master GitHub, all in one place.
Go to Docs
GitHub
Build what's next on GitHub, the place for anyone from anywhere to build anything.
Start building
Customer stories
Meet the companies and engineering teams that build with GitHub.
Learn more
GitHub Universe 2026
Join us October 28-29 in San Francisco or online for GitHub Universe, our flagship developer event uniting people, agents, and the world's code.
Register now

We do newsletters, too

Discover tips, technical guides, and best practices in our biweekly newsletter just for devs.

AI & ML
- AI & ML
  Learn about artificial intelligence and machine learning across the GitHub ecosystem and the wider industry.
  Generative AI
  Learn how to build with generative AI.
  GitHub Copilot
  Change how you work with GitHub Copilot.
  LLMs
  Everything developers need to know about LLMs.
  Machine learning
  Machine learning tips, tricks, and best practices.
  How AI code generation works
  Explore the capabilities and benefits of AI code generation and how it can improve your developer experience.
  Learn more
Developer skills
- Developer skills
  Resources for developers to grow in their skills and careers.
  Application development
  Insights and best practices for building apps.
  Career growth
  Tips & tricks to grow as a professional developer.
  GitHub
  Improve how you use GitHub at work.
  GitHub Education
  Learn how to move into your first professional role.
  Programming languages & frameworks
  Stay current on what’s new (or new again).
  Get started with GitHub documentation
  Learn how to start building, shipping, and maintaining software with GitHub.
  Learn more
Engineering
- Engineering
  Get an inside look at how we’re building the home for all developers.
  Architecture & optimization
  Discover how we deliver a performant and highly available experience across the GitHub platform.
  Engineering principles
  Explore best practices for building software at scale with a majority remote team.
  Infrastructure
  Get a glimpse at the technology underlying the world’s leading AI-powered developer platform.
  Platform security
  Learn how we build security into everything we do across the developer lifecycle.
  User experience
  Find out what goes into making GitHub the home for all developers.
  How we use GitHub to be more productive, collaborative, and secure
  Our engineering and security teams do some incredible work. Let’s take a look at how we use GitHub to be more productive, build collaboratively, and shift security left.
  Learn more
Enterprise software
- Enterprise software
  Explore how to write, build, and deploy enterprise software at scale.
  Automation
  Automating your way to faster and more secure ships.
  CI/CD
  Guides on continuous integration and delivery.
  Collaboration
  Tips, tools, and tricks to improve developer collaboration.
  DevOps
  DevOps resources for enterprise engineering teams.
  DevSecOps
  How to integrate security into the SDLC.
  Governance & compliance
  Ensuring your builds stay clean.
  Secure software development
  GitHub recognized as a Leader in the Gartner® Magic Quadrant™ for AI Code Assistants
  Learn why Gartner positioned GitHub as a Leader for the second year in a row.
  Learn more
News & insights
- News & insights
  Keep up with what’s new and notable from inside GitHub.
  Company news
  An inside look at news and product updates from GitHub.
  Octoverse
  Insights into the state of open source on GitHub.
  Policy
  The latest policy and regulatory changes in software.
  Product
  The latest on GitHub’s platform, products, and tools.
  Research
  Data-driven insights around the developer ecosystem.
  The library
  Older news and updates from GitHub.
  Unlocking the power of unstructured data with RAG
  Learn how to use retrieval-augmented generation (RAG) to capture more insights.
  Learn more
Open Source
- Open Source
  Everything open source on GitHub.
  Gaming
  Explore open source games on GitHub.
  Git
  The latest Git updates.
  Maintainers
  Spotlighting open source maintainers.
  Social impact
  How open source is driving positive change.
  An introduction to innersource
  Organizations worldwide are incorporating open source methodologies into the way they build and ship their own software.
  Learn more
Security
- Security
  Stay up to date on everything security.
  Application security
  Application security, explained.
  Supply chain security
  Demystifying supply chain security.
  Vulnerability research
  Updates from the GitHub Security Lab.
  Web application security
  Helpful tips on securing web applications.
  The enterprise guide to AI-powered DevSecOps
  Learn about core challenges in DevSecOps, and how you can start addressing them with AI and automation.
  Learn more

Explore more from GitHub

Docs

GitHub

Customer stories

GitHub Universe 2026

We do newsletters, too

Explore more from GitHub

Docs

GitHub

Customer stories

GitHub Universe 2026

How to secure GitHub Actions workflows: 4 tips to handle untrusted input and tighten permissions

Jaroslav Lobacevski

Kevin Backhouse

Securing the open source supply chain across GitHub