Skip to main content

​
The big picture

Whether you run the CLI or the web dashboard, the same scan engine inspects the same workflow YAML with the same rules. That’s the whole design in one line — everything below is a consequence of it.

​
One engine, two ways to run it

The CLI reads workflow files from disk; the dashboard reads them from the GitHub API. After that, both hand the exact same bytes to the exact same detection logic. Because the engine is shared, the CLI and the dashboard always produce identical findings for the same workflow file and the same ruleset. There’s no “the web version catches more” — a finding you see in one, you see in the other.

​
Two things Pipefort asks GitHub for

Signing in and granting repo access are separate steps. One says who you are; the other says which repos Pipefort may read.

Sign in with GitHub

Establishes who you are. Pipefort receives only your identity — no repo access comes from signing in.

Install the GitHub App

Grants read access to your repos’ workflows. This is a separate, explicit install step, and it’s read-only unless you use an auto-fix.

​
Your data stays yours

Scan history, findings, and settings are isolated per organization — you only ever see data belonging to organizations you’re a member of.

​
Nothing is cloned

The dashboard never runs git clone. It fetches just the workflow YAML over the GitHub API and scans it directly, so a per-repo scan is fast and your source code is never copied onto Pipefort’s servers. Organization-wide scans run one short request per repo, with live progress. The CLI’s -g owner/repo mode does make a shallow clone — it’s a one-shot command on your own machine, not a hosted service.