A developer livestream walkthrough of GASA (GitHub Actions Security Analyzer), a new open-source Golang CLI tool that scans GitHub repositories for security misconfigurations in GitHub Actions settings. The tool checks seven key security rules including: dangerous use of pull_request_target events, unpinned action references (SHA pinning), default workflow token permissions (read/write vs read-only), and whether external contributor PRs automatically trigger workflows. It can scan individual repos, lists of repos, or entire organizations/users, and outputs results as console text or HTML reports. The session also covers how these misconfigurations have enabled real-world supply chain attacks — where attackers submit PRs to repos using pull_request_target to exfiltrate secrets via base64-encoded output — and explains GitHub's slow rollout of safer defaults for new vs. existing repositories.