What is Soteria
Introducing Soteria and how you can use it to analyze the security misconfigurations of your GitHub workflows
Introduction
Soteria is a misconfiguration detector for GitHub workflow files. It has been designed to be modular, so that custom detectors can be added by the user. This tool caters to both developers and researchers, offering outputs for developers and JSON files containing detailed results for researchers.
Links
Codeberg Repository
The whole codebase for Soteria is open source and available on Codeberg.
VSCode Extension
A VSCode extansion of Soteria is available on the VisualStudio Marketplace
Citation
If you use this software in your work, please include the following citation:
E. Riggio and C. Pautasso, "Pipelines Under Pressure: An Empirical Study of Security Misconfigurations of GitHub Workflows", 26th International Conference on Product-Focused Software Process Improvement (PROFES), Springer, 2025, doi: 10.1007/978-3-032-12089-2_14.License
The code for Soteria is available on Codeberg under the MIT license.