ONE FILE. ONE REVIEWABLE PR.

Your next PR.
A security check included.

Add a free dependency audit to GitHub Actions. No Offense account, API key or paid scans. You review the workflow before it runs.

01 / CHOOSE YOUR REPOSITORY

Add Offense

No token to paste. No repository access granted to Offense. This page prepares a link; it does not create a branch or PR for you.

02 / REVIEW. MERGE. AUDIT.

A small diff.
A clear starting point.

.github/workflows/offense.yml

Runs on pull requests. Also run it manually from the Actions tab after merging.
Reads npm and pnpm lockfiles. Does not install your app, execute its scripts, edit code or post comments.
Leaves evidence, not surprise fixes. Download scan.json and remediation.md from the run. Advisories are report-only; coverage warnings and scan errors fail the check.
Pinned and read-only. Offense and Actions are commit-pinned. The workflow requests only contents: read.

Before you merge

Dependency names and versions go to OSV/npm. Reports stay in GitHub Actions artifacts for 7 days and may contain sensitive details. GitHub Actions usage limits and charges still apply. This is a dependency check, not the full scanner catalog.

Prefer to add the file yourself?

Download the workflow template ↓ or follow the manual PR instructions ↗. If your repo already has offense.yml, update it in a branch instead of overwriting it. GitHub may require sign-in, a fork, organization approval or Actions enablement.

Your next PR.A security check included.

Add Offense

Ready for

Prefer to add the file yourself?

Your next PR.
A security check included.