Scharf – Find and protect ur GitHub Actions from supply-chain attacks

Hacker News

Welcome to "Scharf", a blazing-fast security scanner for hardening third-party GitHub actions with mutable references. Using mutable references (version tags, main/master/dev etc.) is a security vulnerability that can result in supply-chain attacks. The recent `tj-actions/changed-files` security incident is scary, so we built a mutable-reference scanner that performs a deep scan across branches to identify all third-party GitHub actions used in organization Git projects. The output report can be exported to CSV or JSON (default). Try it out!

Visit product View on Hacker NewsMar 31, 2025

Share card

Actual performance

1points

Did not reach leaderboard

Launch Intel predictions

Analyze your own launch →

Product HuntUnlikely to reach the leaderboard · Strong signals: using · Missing: mac, agents, macos

49%49% predicted probability of success on Product Hunt, based on ML models trained on real launch data.

best fitHighest predicted score across all platforms for this description.

TrustMRRLess likely to generate early MRR · Strong signals: scanner · Missing: mobile apps, ios, personal

41%41% predicted probability of success on TrustMRR, based on ML models trained on real launch data.

AppSumoMay struggle as an AppSumo deal · Missing: plus, platform, intuitive

39%39% predicted probability of success on AppSumo, based on ML models trained on real launch data.

Indie HackersIH features products with proven revenue · Missing: supports, reddit linkedin, podcasting

37%37% predicted probability of success on Indie Hackers, based on ML models trained on real launch data.

Hacker NewsMay not resonate with HN audience · Strong signals: ide, io · Missing: https docs, excited, just released

36%36% predicted probability of success on Hacker News, based on ML models trained on real launch data.

nativeThis product was originally launched on this platform.

Acquire.comPre-revenue stage for this audience · Missing: arr, mrr, revenue

17%17% predicted probability of success on Acquire.com, based on ML models trained on real launch data.

BetaListMay not resonate with beta-testers · Missing: web3, chat, crypto

10%10% predicted probability of success on BetaList, based on ML models trained on real launch data.

Correct prediction on native model

Similar products

Litterbox – Defend Against Supply Chain Attacks50%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

Litterbox – Defend Against Supply Chain Attacks

Hacker News1

Abom – Actions Bill of Materials for GitHub Actions Supply Chains32%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

Abom – Actions Bill of Materials for GitHub Actions Supply Chains

Hacker News2

Centrum-Ai42%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

Supply Chain Resilience AI

Indie Hackerscommitment-full-time

ChainTraced23%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

Modernising supply-chain traceability and quality assurance

Indie Hackers

GitHub Actions for Pixela23%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

GitHub Actions for Pixela

Hacker News2

Sticky Disks in GitHub Actions31%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

Sticky Disks in GitHub Actions

Hacker News13

Butler – GitHub Actions Oversight Across Organisations23%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

Butler – GitHub Actions Oversight Across Organisations

Hacker News2

FineLine Technologies46%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

Supply Chain

Indie Hackerscommitment-full-time

ChainCentral – AI supply chain planning tool24%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

ChainCentral – AI supply chain planning tool

Hacker News1

Provenant Supply Chain Collaboration24%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

Manufacturing supply chain visibility, fast.

Product Hunt+10

Browse all products Analyze your launch