I also agree that there are potentially better ways to *structure* this kind of dependency awareness, but a public registry + consensus mechanism requires people to commit to building and operating those things, which isn't trivial! That's something I think needs future work, though

those are good questions that a lot of people had! I covered them in some detail in a follow-up here:

blog.yossarian.net/2025/12/13/c...

TL;DR yes, the assumption is that security scanners provide more value than users incidentally tripping over malware, i.e. universalization is not a concern

thank you, fixed!

thanks for the kind words!

I'm a big fan of zizmor.sh by
@yossarian.net to provide static analysis of GitHub Actions workflows as I'm working on them. The remediation advice is also top notch, for `pull_request_target` as an example: docs.zizmor.sh/audits/#dang...

that would be so awesome!

I didn’t know that! This is like trying ketchup chips in Canada and realizing I couldn’t get them in the US