Skip to main content
The landing page at pipefort.com lets anyone scan a public GitHub repository without signing in: type owner/repo after the github.com/ prefix (or paste a full GitHub URL) and get an instant partial report. The page also scans a well-known public repository on load, so the card you land on is a real report rather than a mock-up — reproducible by typing the same repository name yourself.

​
What the teaser scans

The anonymous scan runs the same engine as the rest of Pipefort, with a deliberately reduced scope:
  • Workflow files only (.github/workflows/*.yml|yaml), fetched over the GitHub API at the repository’s default branch — no clone.
  • No repository-settings audit (branch protection, secret scanning, Actions permissions) — those checks need permissions an anonymous scan doesn’t have. Sign in and install the GitHub App to get them.
  • No online supply-chain pin audit — also sign-in-only.
  • Hard caps: at most 60 workflow files per repo (the report is marked truncated past that) and workflow files over 512 KB are skipped.

​
What you see vs. what’s withheld

The teaser shows the full severity counts and the top 3 findings (severity, rule, OWASP category, title), chosen worst-severity-first with high-confidence findings preferred and at most one finding per rule. Withheld until you sign in: every finding’s file, line, description, and fix recommendation, and the rest of the findings list. The gate is enforced server-side — the withheld fields are never present in the API response. Each scan gets a stable share URL, pipefort.com/scan/{slug}, that replays the stored result. Results are cached for one hour per repository — repeat scans (and everyone opening a shared link) get the cached report instantly.

​
Privacy

Anonymous scans store aggregates only: severity and rule counts plus the top-3 teaser snapshot (severity, rule, category, title). No file paths, line numbers, or workflow contents are persisted — the “we never store your source code” promise holds for anonymous scans too. The sign-in page also shows aggregated, anonymized statistics across all Pipefort scans (“what we’re finding in the wild”): total repos scanned, findings, and the ten most-firing rules. The aggregate is computed over each repository’s latest scan and contains rule identifiers and counts only — customer repositories, organizations, and users are never identified. The “recently scanned” ticker lists anonymous public teaser scans exclusively (public repositories by definition), never customer repos.

​
Rate limits

To keep the free scanner fair, anonymous scans are rate-limited to 5 scans per minute per client IP and 30 scans per minute total, plus a 1-hour per-repo result cache so repeat scans and shared links return instantly. A shared report leads with the repository — name, branch, workflow-file count and scan age — then the severity distribution, then the findings the API chose to reveal. The withheld set is stated by its real severity breakdown: the scan’s own counts minus the severities present in the revealed findings. Anonymous callers never receive the file, the line number, the description or the fix for any finding, revealed or not — signing in returns all four, plus the repo-settings audit, pin analysis and attack-chain detection that a public scan does not run at all. If the result is cached, the page says so and offers a re-scan: a link opened three weeks later would otherwise present old data as current.