Goal: Quickly locate GitHub Actions workflow exposures / misconfigs inside a specific Bug Bounty program org (GitHub search, code search, and dorks). Assume target org: ORG_NAME.

---

1. Find All Workflows in Target Org

org:ORG_NAME path:.github/workflows language:YAML

Full example of Google:

(("run:" OR "run: |") AND "${{ github.event") path:.github/workflows language:YAML (org:bazelbuild OR org:angular OR org:golang OR org:protocolbuffers OR org:tink-crypto OR org:google OR org:flutter OR org:openthread OR org:GoogleContainerTools) NOT is:archived

("github.event.pull_request" OR "github.event.issue" OR "github.event.comment") path:.github/workflows language:YAML (org:bazelbuild OR org:angular OR org:golang OR org:protocolbuffers OR org:tink-crypto OR org:google OR org:flutter OR org:openthread OR org:GoogleContainerTools) NOT is:archived

---

2. High-Risk Patterns in Workflows

Secrets Exposure / Logging

org:ORG_NAME path:.github/workflows ("echo ${{ secrets." OR "echo \"${{ secrets.")

org:ORG_NAME path:.github/workflows ("set-output" AND "secrets")

---

Dangerous Pull Request Triggers

Search workflows triggered by PR from forks.

org:ORG_NAME path:.github/workflows "pull_request_target"

Combine with shell execution:

org:ORG_NAME path:.github/workflows "pull_request_target" "run:"

---

Checkout of PR Code (classic vuln)

org:ORG_NAME path:.github/workflows "actions/checkout" "pull_request_target"

More precise:

org:ORG_NAME path:.github/workflows "ref: ${{ github.event.pull_request.head.sha }}"

---

Script Injection via PR Inputs

org:ORG_NAME path:.github/workflows "github.event.pull_request"

org:ORG_NAME path:.github/workflows "github.event.issue"

org:ORG_NAME path:.github/workflows "github.event.comment"

---

3. Command Injection Patterns

Search for unsafe variable interpolation in shell.

org:ORG_NAME path:.github/workflows "run:" "${{ github.event"

org:ORG_NAME path:.github/workflows "run: |" "${{ github."

Regex idea (ripgrep / local):

run:.*\${{\s*github\.event\..*}}

---

4. Dangerous Self Hosted Runners

org:ORG_NAME path:.github/workflows "self-hosted"

Combined with PR:

org:ORG_NAME path:.github/workflows "self-hosted" "pull_request"

---

5. Workflow Write Permissions (Token Abuse)

org:ORG_NAME path:.github/workflows "permissions:"

Look for:

permissions: write-all
permissions: contents: write

Search directly:

org:ORG_NAME path:.github/workflows "write-all"

---

6. Workflow Dispatch Abuse

org:ORG_NAME path:.github/workflows "workflow_dispatch"

Combined with secrets usage:

org:ORG_NAME path:.github/workflows "workflow_dispatch" "secrets"

---

7. Third-Party Action Supply Chain

org:ORG_NAME path:.github/workflows "uses:"

Unpinned actions:

org:ORG_NAME path:.github/workflows "uses:" "@master"

org:ORG_NAME path:.github/workflows "uses:" "@main"

---

8. Artifact Poisoning

org:ORG_NAME path:.github/workflows "upload-artifact"

org:ORG_NAME path:.github/workflows "download-artifact"

---

9. Cache Poisoning

org:ORG_NAME path:.github/workflows "actions/cache"

---

10. Dangerous Env Injection

org:ORG_NAME path:.github/workflows "env:"

Combined:

org:ORG_NAME path:.github/workflows "env:" "github.event"

---

11. Full Regex Pack (Local Scan)

If you clone org repos and scan:

pull_request_target
github\.event\.
secrets\.
self-hosted
workflow_dispatch
permissions:\s*write
uses:.*@(main|master)
run:.*\${{.*github\.event

---

12. High Signal One-Liner

Best GitHub dork I use for bounty:

org:ORG_NAME path:.github/workflows ("pull_request_target" OR "self-hosted" OR "workflow_dispatch" OR "github.event")

---

13. Bonus: Find Vulnerable Workflows Across GitHub

path:.github/workflows "pull_request_target" "run:"

path:.github/workflows "github.event.pull_request.title" "run:"

---

14. Automation (CLI)

GitHub CLI:

gh search code 'org:ORG_NAME path:.github/workflows pull_request_target'

Mass scanning:

gh search code 'path:.github/workflows "github.event"' --limit 500

language:YAML path:/^\.github\/workflows\// (org:google OR org:googleapis OR org:googlecloudplatform)

Search In facebook

("github.event.issue.title" OR "github.event.issue.body" OR "github.event.pull_request.title" OR "github.event.pull_request.body") language:YAML path:/^\.github\/workflows\// (org:facebookincubator OR org:facebook)

FB

("github.event." OR "github.head_ref") AND "run:" language:YAML path:/^\.github\/workflows\// (org:facebookincubator OR org:facebook)

Amazon

("github.event." OR "github.head_ref") AND "run:" language:YAML path:/^\.github\/workflows\// (org:amzn OR org:aws)

("github.event.issue.title" OR "github.event.issue.body" OR "github.event.pull_request.title" OR "github.event.pull_request.body" OR "github.event.comment.body") language:YAML path:/^\.github\/workflows\//