zizmor
Hacker ApprovedThe most recommended of 12 static analyzers
Free static analyzer for GitHub Actions that catches security issues such as template injection. Critics say it produces many false positives.
Free static analyzer for GitHub Actions that catches security issues such as template injection. Critics say it produces many false positives.
20 people gave an opinion
- recommend it
- 19
- criticize it
- 1
- approval share
- 95%
Recommended in 6 of 13 months
- November 2025: not recommended
- December 2025: recommended
- January 2026: not recommended
- February 2026: not recommended
- March 2026: recommended
- April 2026: recommended
- May 2026: recommended
- June 2026: recommended
- July 2026: not recommended
- August 2026: recommended
- September 2026: not recommended
- October 2026: not recommended
- November 2026: not recommended (month in progress)
Why it carries the badge
- 19 people recommend itNeeds 10 or more, met.
- 19 recommenders for every criticNeeds 2 to 1 or better, met.
- Recommended in 6 of 13 monthsNeeds 4 or more, met.
The same three rules apply to every product, and the badge can’t be bought. How the badge works
What people say about it
The reasons people give, with the number of comments that give each one. Open a reason to read what they said.
Why people recommend it
Each mark is one comment
Static analysis for GitHub Actions security
“Static analyzers like https://github.com/zizmorcore/zizmor can help find such misconfiguration.”
Comment from 12 May 2026 in “TanStack NPM Packages Compromised” “It is negligent to write GitHub Actions without using static analysis.”
Comment from 17 Aug 2026 in “AI-Generated GitHub Copilot "Autofix" Allowed Compromise of Snowflake's Jira” “you can add zizmor that warns about things like this”
Comment from 11 Apr 2026 in “JSON Formatter Chrome Plugin Now Closed and Injecting Adware” - Comment from 20 May 2026 in “GitHub is investigating unauthorized access to their internal repositories”
Detects template injection and branch names
“zizmor detects quite a few typical injection patterns like branch names”
Comment from 6 Mar 2026 in “A GitHub Issue Title Compromised 4k Developer Machines” “zizmor checks for template injection.”
Comment from 20 May 2026 in “GitHub is investigating unauthorized access to their internal repositories” Useful in practice on real repos
“Recently discovered it and found it genuinely useful.”
Comment from 20 May 2026 in “GitHub is investigating unauthorized access to their internal repositories” “just ran and fixed all issues on our core repos”
Comment from 20 May 2026 in “GitHub is investigating unauthorized access to their internal repositories”
What people warn about
Each mark is one comment
Misses deep composite actions and runtime injection
“they struggle with deep composite actions trees and runtime template injection”
Comment from 28 Apr 2026 in “GitHub Actions is the weakest link”
Other static analyzers people recommend
The four most recommended other static analyzers, with the same counts for each, so you can compare like for like. The tick on each bar marks the 2 to 1 line the badge needs.
| Product | Recommend | Criticize | Approval | Months | Owned | Badge |
|---|---|---|---|---|---|---|
| zizmorThis page | 19 | 1 | 95% | 6 | — | Approved |
| Semgrep | 14 | 10 | 58% | 7 | — | — |
| clang-tidy | 14 | 4 | 78% | 6 | — | Approved |
| PHPStan | 11 | 0 | 100% | 7 | — | Approved |
| SonarQube | 10 | 13 | 43% | 6 | — | — |
What people said
19 of the 26 comments that mention it, newest first. Each links to the original comment.
“zizmor produces an overwhelming majority of false positives here for what feels like arbitrary and very context-dependent GHA requirements”
“thanks for your work, I'll want to start using it!”
“This is a really cool tool!”
“It is negligent to write GitHub Actions without using static analysis.”
“am I going to footgun myself?”
“It will significantly improve your posture.”
“zizmor checks for template injection.”
“Recently discovered it and found it genuinely useful.”
“just ran and fixed all issues on our core repos”
“Maybe zizmor could catch this”
“Use Static analysis for GHA to catch security issues”
“Static analyzers like https://github.com/zizmorcore/zizmor can help find such misconfiguration.”
“it only does it for two known actions so far”
“zizmor (and other tools) correctly recovers vulnerability information for SHA-pinned actions”
“they struggle with deep composite actions trees and runtime template injection”
“you can add zizmor that warns about things like this”
“zizmor is probably better than starting with an LLM”
“zizmor detects quite a few typical injection patterns like branch names”
“pair nicely, even if the latter is a bit of an involved setup”
Counts come from 1,795,640 Hacker News comments, November 2025 to November 2026. How we count. Report a mistake.