WorkflowFence

Who it's for

security/platform engineers at orgs running AI autofix bots (Copilot Autofix, Dependabot security PRs, Snyk fix PRs) who today rely on manual PR review or trust the bot's default scope.

The problem

legal/security risk: an AI-authored PR can silently escalate CI/CD permissions or add a new external Action (as in the Snowflake Jira compromise via Copilot Autofix), and manual review of every autofix PR gets skipped once volume rises — no automated gate exists that treats bot PRs as untrusted by default.

How to build it

GitHub App installed as a required status check; parses the diff of any PR authored by a recognized bot account for changes to .github/workflows/*, action.yml, permissions blocks, or new 'uses:' references, and fails the check with a line-level explanation until a human approves.

How it makes money

security or platform teams pay $29-99/month per org because one missed permission escalation costs far more than the subscription, and CODEOWNERS alone can't parse diff-level permission/action changes inside workflow YAML.

Why it doesn't exist yet

GitHub and Snyk won't build a gate that flags their own autofix bot's overreach since it undermines the 'autofix saves you time' pitch; the gap is a neutral third-party check that treats every vendor's autofix bot the same way, which no platform vendor is incentivized to ship.

First users

security engineers who read the Wiz Snowflake/Copilot Autofix writeup this week and want an immediate gate on their own bots' PRs, reached via a GitHub Marketplace listing and a direct HN/Twitter post referencing that incident.

Build size

2 people x 10 weeks - includes GitHub App webhook, workflow/permission diff parser, PR-comment and Slack alerts, weekly digest; excludes GitLab/Bitbucket CI and non-GitHub-Actions runners in v1.

Biggest risk

GitHub ships a native 'restrict autofix bot permissions' toggle, or teams solve this with existing CODEOWNERS protected-paths rules on .github/workflows/, removing the need for a specialized diff parser.

Conditions for a hit (all 3 required)

• Fails a required check on any bot-authored PR that modifies .github/workflows/*.yml, action.yml, or a repo permissions block, showing the exact changed lines
• Flags any newly added external Action reference (uses: owner/repo@ref) not previously present in the repo's workflow files, naming the action and version
• Posts a weekly digest listing every autofix-bot PR merged that week with an added/removed permission-scope summary

How it's judged (in 6 months)

GitHub Marketplace listing shows 100+ active installs, or Product Hunt daily top 5(judgment date 2027-02-18)

AI self-confidence 38/100 — self-reported likelihood of meeting the criterion, not a business success rate