> ## Documentation Index
> Fetch the complete documentation index at: https://docs.pipefort.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Secure Workflow Hardener

> Paste a GitHub Actions workflow and get a hardened version back — restricted permissions, SHA-pinned actions, and more. Free, no sign-in.

The **Secure Workflow Hardener** at
[`pipefort.com/harden`](https://pipefort.com/harden) is a free, no-sign-in tool:
paste a GitHub Actions workflow, choose which fixes to apply, and get the
hardened YAML back to copy into your repo.

It runs the **same in-memory auto-fixer** as the app's
[**Open fix PR**](/webapp/pr-checks) button — Pipefort scans the pasted content,
then rewrites it deterministically. The workflow you paste is **never stored**:
the transform happens on the request and the result is returned inline.

## How it works

1. **Paste** your `.github/workflows/*.yml` into the editor (or load the
   example).
2. **Harden** — Pipefort scans the YAML and applies every available fix,
   showing the result immediately.
3. **Tick the fixes you want** — each applicable fix is a checkbox. Toggle any
   of them to re-harden with just the changes you want, then **Copy** the result.

## What it fixes

The hardener applies the auto-fixable subset of Pipefort's rules, grouped into
selectable fixes:

| Fix                                     | What it does                                                                                                    |
| --------------------------------------- | --------------------------------------------------------------------------------------------------------------- |
| **Restrict `GITHUB_TOKEN` permissions** | Adds a restrictive top-level `permissions:` block when none is set.                                             |
| **Pin actions to a commit SHA**         | Rewrites `uses: owner/action@v4` to the full 40-character commit SHA (with the version preserved as a comment). |
| **Harden risky triggers & checkout**    | Neutralizes dangerous `pull_request_target` checkouts of untrusted code and `persist-credentials` on checkout.  |
| **Replace hardcoded secrets**           | Moves inline secrets to `${{ secrets.* }}` references.                                                          |
| **Add job timeouts**                    | Adds a `timeout-minutes` to jobs that lack one.                                                                 |

The exact set reflects Pipefort's auto-fixable rules and grows as more fixers
land. Only the fixes that actually apply to *your* workflow are shown.

<Note>
  **Pinning to a SHA resolves the tag over the public GitHub API.** That step
  needs network access, so a very large workflow with many unpinned actions can
  take a few seconds — or you can uncheck **Pin actions to a commit SHA** to skip
  it. Every other fix is a purely local text transform.
</Note>

## Relationship to scanning

The hardener is a quick, anonymous way to clean up a single file. For ongoing
coverage — every workflow in every repo, with history, trends, and one-click
**fix PRs** — connect the repository and let Pipefort
[scan](/webapp/overview) it. Same fixer, applied continuously.