MSRXTools / Developers
CI, Docker & Kubernetes config checker
Paste a GitHub Actions workflow, Dockerfile, Kubernetes manifest or Compose file and find pwn requests, script injection, unpinned actions, root containers and leaked secrets.
Runs in your browser
Loading tool…
Good to know
- The most damaging GitHub Actions bug is pull_request_target plus checking out the PR's code: a stranger's code runs with your secrets.
- Pin third-party actions to a full commit SHA; tags can be moved, as happened to tj-actions/changed-files in March 2025.
- Containers should run as a non-root user with all capabilities dropped. A privileged container or a mounted Docker socket gives away the host.
Related tools
Hash & checksum generator
SHA-1, SHA-256, SHA-384 and SHA-512 of text or a file, plus checksum verification for downloads.JWT decoder & auditor
Decode a JSON Web Token and flag the risky parts: alg none, expired or missing exp, long lifetimes and sensitive claims.Leaked secret finder
Paste code, logs or config and find API keys, tokens and private keys before you commit or share them.Website vulnerability scanner
Paste a URL. Get a SWOT security report scored out of 10: HTTPS, TLS, headers, cookies, content, DNS and email, with fixes.
SHA-1, SHA-256, SHA-384 and SHA-512 of text or a file, plus checksum verification for downloads.JWT decoder & auditor
Decode a JSON Web Token and flag the risky parts: alg none, expired or missing exp, long lifetimes and sensitive claims.Leaked secret finder
Paste code, logs or config and find API keys, tokens and private keys before you commit or share them.Website vulnerability scanner
Paste a URL. Get a SWOT security report scored out of 10: HTTPS, TLS, headers, cookies, content, DNS and email, with fixes.