# zizmor

19 Hacker News commenters recommended zizmor and 1 criticized it, November 2025 to November 2026. It was recommended in 6 of 13 months. It meets the Hacker Approved badge rule.

**Verdict:** Free static analyzer for GitHub Actions that catches security issues such as template injection. Critics say it produces many false positives.

## Why people recommend it

- Static analysis for GitHub Actions security (4 comments): "Static analyzers like https://github.com/zizmorcore/zizmor can help find such misconfiguration." ([source](https://news.ycombinator.com/item?id=48107634)) "It is negligent to write GitHub Actions without using static analysis." ([source](https://news.ycombinator.com/item?id=49333161)) "you can add zizmor that warns about things like this" ([source](https://news.ycombinator.com/item?id=47727106))
- Detects template injection and branch names (2 comments): "zizmor detects quite a few typical injection patterns like branch names" ([source](https://news.ycombinator.com/item?id=47273550)) "zizmor checks for template injection." ([source](https://news.ycombinator.com/item?id=48202397))
- Useful in practice on real repos (2 comments): "Recently discovered it and found it genuinely useful." ([source](https://news.ycombinator.com/item?id=48202358)) "just ran and fixed all issues on our core repos" ([source](https://news.ycombinator.com/item?id=48202285))

## What people warn about

- Misses deep composite actions and runtime injection (1 comments): "they struggle with deep composite actions trees and runtime template injection" ([source](https://news.ycombinator.com/item?id=47937843))

## Alternatives hackers recommend

- [Semgrep](https://hackerapproved.com/p/semgrep.md): 14 recommend
- [clang-tidy](https://hackerapproved.com/p/clang-tidy.md): 14 recommend
- [PHPStan](https://hackerapproved.com/p/phpstan.md): 11 recommend
- [SonarQube](https://hackerapproved.com/p/sonarqube.md): 10 recommend
- [CodeQL](https://hackerapproved.com/p/codeql.md): 9 recommend

## Cite as

Hacker Approved, "zizmor", https://hackerapproved.com/p/zizmor/ (counts from 1,795,640 Hacker News comments, November 2025 to November 2026).