drop workflow logs · secret patterns · nc/curl suspicious · permissions summary · critical banner · export csv · runs locally
workflow logs
drop .log / .txt (multiple ok)
or click
scans for AKIA keys, gh tokens, netcat, piped curl, broad permissions
drop one or more workflow .log / .txt files