GitHub Actions Security Workshop

Each challenge is a repository with a vulnerable GitHub Actions workflow. Your goal: exploit it to extract a secret token, then use that token to open an issue in the corresponding flag repo.

---

How to play

1. Pick a challenge below and read its README
2. Trigger the workflow (open a PR, post an issue comment, etc. — the README tells you how)
3. Exploit the vulnerability to extract WORKSHOP_TOKEN
4. Submit your flag:

curl -X POST \
  -H "Authorization: Bearer WORKSHOP_TOKEN" \
  -H "Accept: application/vnd.github+json" \
  https://api.github.com/repos/kodeverksted/flag-N/issues \
  -d '{"title":"Flag","body":"user: YOUR_GITHUB_USERNAME"}'

Replace WORKSHOP_TOKEN, N, and YOUR_GITHUB_USERNAME accordingly.

Play rules

• Tokens are automatically rotated every 5 minutes, or on demand.
• Please do not leak tokens intentionally, GitHub will automatically revoke them interrupting the challenge for everyone.
• BUT mistakes happen, do not be afraid to experiment! Just don't keep leaking tokens over and over again.
• If you get 401 when trying to use a challenge token, wait a minute and fetch a newly issued one by triggering the workflow again.

---

Challenges

#	Difficulty	Repo
1	🟢 Easy	challenge-1
2	🟢 Easy	challenge-2
3	🟡 Medium	challenge-3
4	🟡 Medium	challenge-4
5	🟠 Hard	challenge-5
6	🟠 Hard	challenge-6
7	🔴 Expert	challenge-7

---

Scoreboard

https://kodeverksted.github.io/scoreboard/