zizmor is a static analysis tool for GitHub Actions.
It can find many common security issues in typical GitHub Actions CI/CD setups, including:
- Template injection vulnerabilities, leading to attacker-controlled code execution
- Accidental credential persistence and leakage
- Excessive permission scopes and credential grants to runners
- Impostor commits and confusable git references
- ...and much more!
Publisher’s description
What is zizmor?
zizmor by William Woodruff is open-source Windows software. It is written in Rust.
Installation and requirements
The publisher provides Portable installers for 64-bit Windows. It runs without installation (portable).
Updates and version history
The current version is 1.31.1, released on October 15, 2026. The version history goes back to December 18, 2025: 20 releases, all linked to the official files. The last update is less than a month old.
Popularity and file types
The source code on GitHub (zizmorcore/zizmor) has 6,755 stars.
Project description on GitHub: “Static analysis for GitHub Actions (and more)”
Pros / Cons
Pros
- Open source: the code can be inspected and built by anyone
- Portable: runs without installation
- Updated in the last two months
- Large user base
Cons
- No native ARM64 build
In short: zizmor is an open-source Windows tool for 64-bit PCs.
Is zizmor safe to download?
- The file is served by github.com, the publisher’s own domain
- The download link uses HTTPS
- A SHA256 hash is published, so you can verify the file:
4DE30371C8A3B483AECBCF0DEC1FD6A2B6AAE65051CA226B4F6527BAAC6A8C7A· Open the VirusTotal report for this hash - The link has not been checked yet
- The source code is public
- ExeAtlas does not host, wrap or modify installers
Related guide: How to check a file’s SHA256 hash on Windows
Recent versions
All 20 versions ›| Version | Date | Size | Files |
|---|---|---|---|
| 1.31.1Latest | October 15, 2026 | — | 64-bit ZIP |
| 1.31.0 | October 15, 2026 | — | 64-bit ZIP |
| 1.30.1 | September 9, 2026 | — | 64-bit ZIP |
| 1.30.0 | August 30, 2026 | — | 64-bit ZIP |
| 1.29.0 | August 1, 2026 | — | 64-bit ZIP |
| 1.28.0 | July 21, 2026 | — | 64-bit ZIP |
| 1.27.0 | July 14, 2026 | — | 64-bit ZIP |
| 1.26.1 | June 21, 2026 | — | 64-bit ZIP |
Install from the command line
Silent install ›winget install --id zizmor.zizmor -escoop install main/zizmorProgram files (.exe): zizmor.exe
Related guide: How to use winget: install and update apps
Information
- Publisher
- William Woodruff
- Licence
- MIT
- Price
- Free
- Source code
- github.com/zizmorcore/zizmor
- Written in
- Rust
- Requires
- Windows 11 / 10
- Architecture
- 64-bit
- Installer
- Portable
- Version
- 1.31.1
- Released
- October 15, 2026
- Added to the catalogue
- December 23, 2025
- Versions listed
- 20
- GitHub stars
- 6,755
- GitHub forks
- 272
- Website
- zizmor.sh
- winget ID
- zizmor.zizmor
- Scoop package
- main/zizmor
Ratings and reviews
No reviews yet. Be the first to rate it.
Frequently asked questions
Is zizmor free?
Yes. zizmor is open-source software under the MIT licence.
Is zizmor safe to download?
The download comes from github.com, which belongs to the publisher; ExeAtlas does not host or change the file. Compare its SHA256 hash with the one shown here, or open the VirusTotal report for that hash.
How do I install zizmor with winget?
Open PowerShell or Windows Terminal and run the winget command shown on this page. winget downloads the official installer and checks its SHA256 hash before running it.
Does zizmor run on ARM (Windows on Arm)?
There is no ARM64 build; Windows 11 on Arm can run the 64-bit version through emulation.
Where can I download an older version of zizmor?
The versions page lists all 20 versions with links to their official installer files, back to December 18, 2025.
Can I use zizmor without administrator rights?
Yes, it is portable: unpack and run it.