I made a thing... or two. GitHub Actions permissions Monitor and Advisor: #GitHubActions #security
https://github.com/GitHubSecurityLab/actions-permissions
GitHub token permissions Monitor and Advisor actions - GitHubSecurityLab/actions-permissions