Skip to content
Back to the index

pin-deep

PyPIInfrastructure

No liveness check has reached it yet; it is registered on PyPI and has been in the index since 12 Oct 2026. How this is checked

pin-deep is a command-line tool that recursively inspects GitHub Actions dependencies to find unpinned nested uses hidden behind SHA-pinned actions. It helps developers and security teams identify CI/CD supply-chain risks.

Inferred · not functionally tested

Open SourceMITCLISelf-hosted
Visit PyPI

Overview

5 features

Purpose: Detecting unpinned nested GitHub Actions that can introduce software supply-chain risks.

Inferred · not functionally tested

Audience: DevOps and application security engineers

Inferred · not functionally tested

Functions: monitoring

Inferred · not functionally tested

Interfaces: API: unknown · MCP: unknown · CLI: indicated (inferred, not tested) · Self-hosting: indicated (inferred, not tested)

Recorded constraints: pricing: open_source · license: MIT · platforms: CLI · deployment: cli, self_hosted

Constraint provenance is unknown; confirm requirements with the publisher.

Record sources: pypi.org. These links do not verify the individual claims.

In the Application security & vulnerability scanning space, pin-deep takes a focused approach. Inferred · not functionally tested: It focuses on detecting unpinned nested GitHub Actions that can introduce software supply-chain risks. Inferred · not functionally tested: pin-deep is an open-source project aimed at devOps and application security engineers. Basis unknown · not verified: The project is open source (MIT). Basis unknown · not verified: It ships for the command line, and it can be self-hosted.

pin-deep first shipped in 2026. Inferred · not functionally tested: Among its 5 catalogued features are recursive action scanning, nested dependency detection, and SHA pin checking.

Summary written by a language model from the project’s public pages.

Tasks: Inferred · not functionally tested

  • Recursive action scanning
  • Nested dependency detection
  • SHA pin checking
  • Supply-chain analysis
  • GitHub Actions support

Topics: Inferred · not functionally tested

Tags
github-actionssupply-chain-securitydependency-pinningci-security

JSON profile · Text profile · Access guide

Built with & integrations

Connectors
github
Runs on
CLISelf-hosted

Trust & compliance

License
MIT
Public signals
HTTPSOpen SourceFree tier

Indexing history

1

What PulseGate has recorded for this listing

  1. Indexed12 Oct · 07:58 UTC
    pin-deep seen via PyPI Bulk Enumerator
    Source: PyPI Bulk Enumerator · Open

Frequently asked questions about pin-deep

What does pin-deep do?
Inferred · not functionally tested: Pin-deep focuses on detecting unpinned nested GitHub Actions that can introduce software supply-chain risks. It is catalogued under Application security & vulnerability scanning on PulseGate.
Who is pin-deep for?
Inferred · not functionally tested: pin-deep is an open-source project built for devOps and application security engineers.
Is pin-deep free?
Basis unknown · not verified: Yes — pin-deep is open source under the MIT license and free to use.
What platforms does pin-deep run on?
Basis unknown · not verified: pin-deep runs on the command line. It can also be self-hosted.
Is pin-deep still maintained?
Unverified. pin-deep has not been re-checked since it entered the index, so there is no finding either way — and only a positive finding would say otherwise.
What projects are similar to pin-deep?
Similar projects tracked by PulseGate include leakhunterx-agent, Scrapingbypass API, and Fagulha Escudo.leakhunterx-agentScrapingbypass APIFagulha Escudo
How long has pin-deep been around?
pin-deep first shipped in 2026.
Is pin-deep open source?
Basis unknown · not verified: Yes — pin-deep is open source under the MIT license.

Also in Application security & vulnerability scanning

Same category — not a similarity match