Please report security issues privately through GitHub Security Advisories rather than as a public issue.

Expect an acknowledgement within 72 hours and an assessment within seven days.

The latest minor release receives security fixes. This project is pre-1.0.

preempted reads workflow files and prints text. The following are in scope:

• Code execution while scanning. Nothing in a scanned repository should ever be executed. Workflows are parsed as data, run: blocks are analysed as text and never interpreted, and no action referenced by a workflow is fetched or run.
• Denial of service. A crafted workflow that makes a scan hang or exhaust memory. The YAML parser has no alias mechanism, so the billion-laughs class is structurally impossible rather than mitigated; group templates are resolved by string walking, never compiled into regular expressions.
• Report injection. Terminal escape sequences in a group name, a job id or a workflow name that rewrite the screen — hide a finding, or forge a clean verdict. Evidence is control-stripped and length-capped for that reason.
• Path traversal. A construction that gets the reader to read outside .github/workflows of the scanned root.
• Silent under-reporting. A workflow constructed so that a concurrency configuration that will cancel a deploy is reported as healthy. Because this tool is used as a gate in CI, a reliable way to produce a false clean report is worth more to an attacker than a crash.

• A wrong verdict. A missed misconfiguration or a false alarm is a correctness bug and a genuinely useful report, but it is not a security issue. The deliberate under-reporting of opaque expressions documented in docs/semantics.md is by design.
• The CI configuration of repositories preempted scans. That is the finding.
• GitHub Actions' own concurrency scheduler. Races, cancellation timing and queue semantics are properties of the platform; this tool only reads configuration against their documented behaviour.

• No network access. It never contacts GitHub and never resolves an action reference.
• No credentials. It takes no token and reads no secrets. A workflow's secrets and env values are treated as opaque text.
• Read-only. preempted never writes to the repository it scans.
• Zero runtime dependencies. Installing it does not widen your supply chain.
• No install script.