GitHub Actions SHA Pinning: A Practical Security Review Checklist
Review GitHub Actions supply-chain risk with full commit-SHA pins, least-privilege permissions, and a repeatable pull-request checklist.
GitHub Copilot App Access Policy: An Enterprise Security Review Checklist
Review GitHub Copilot app access policies, managed settings, client separation, repository scope, and rollback evidence before enterprise rollout.
Copilot Code Review Agent Skills and MCP: A Security Review Checklist
A practical security review checklist for Copilot code review agent skills and MCP tools, with bounded permissions and human approval.
GitHub Actions Workflow Approval Holds: A Security Review Checklist
GitHub now holds certain potentially malicious GitHub Actions runs for approval in public repositories. Use this bounded review checklist before approving a held workflow.