The previous OAuth flow showed "read and write access to all repositories", the smallest OAuth scope available, but understandably scary. Several people reached out saying they backed out at that screen.
We've migrated to a GitHub App. GitHub now shows "Read access to code and metadata", the minimum possible access to analyze your workflow files.
If that was your blocker, it's gone. Give it a try: pipeaudit.dev
Most teams never audit their CI/CD pipelines until something breaks. PipeAudit scans your GitHub Actions workflows and gives a score out of 100 based on 14 security and best practice rules : unrestricted token permissions, unpinned actions, missing dependency scans, jobs without timeouts, and more. Each issue comes with a concrete fix. Free to get started.
