Automated research artifact — not the upstream project.

This repository is a disposable lab built by an automated harness for a master's thesis at Université Laval on reproducing published GitHub Actions workflow vulnerabilities. It is a verbatim snapshot of live-codes/livecodes at commit 8017e0146fc020b8e9ec4115afc6f7b228354e46 (2026-02-21), redistributed under that project's own licence, whose file is included unchanged in this snapshot.

The upstream project is not involved, is never targeted, and the vulnerability studied here is already public. Every secret and variable in this repository is a randomly generated dummy value — no real credential is present. Action references and runner images are pinned to what they resolved to on 2026-02-21; see pinning.md in the harness output for every change made to the snapshot.

Questions or objections: [email protected]

---

LiveCodes

A Code Playground That Just Works!

A feature-rich, open-source, client-side code playground for React, Vue, Svelte, Solid, Typescript, Python, Go, Ruby, PHP and 90+ languages/frameworks.

Try it now on livecodes.io

Documentations

What makes LiveCodes different?

A Code Playground That Just Works!

• No servers to configure (or pay for!)
• No databases to maintain (or pay for!)
• No installs
• No configuration files
• No build steps
• No subscription fees (free and open-source)
• No account required *
• No limits for usage (unlimited private projects)
• 90+ languages/frameworks/processors
• Large set of features and integrations
• Import code from a wide variety of sources
• Use modules from npm, deno.land/x, jsr, GitHub, and others
• Easily embed it in your web pages
• It runs in the browser (client-side)

_{* GitHub account is required only for features that use GitHub Integration.}

Quick Start

Standalone App

1. Go to livecodes.io

... and enjoy all the features!

Embedded Playground

Add this code to your page:

<div id="container"></div>
<script type="module">
  import { createPlayground } from 'https://cdn.jsdelivr.net/npm/livecodes';

  createPlayground('#container', {
    params: {
      markdown: '# Hello LiveCodes!',
      css: 'h1 {color: dodgerblue;}',
      js: 'console.log("Hello, from JS!");',
      console: 'open',
    },
  });
</script>

^{Check documentations for Embedded Playgrounds.}

Self-hosted

1. Download a release

2. Put it on a static file server (for free!) ^{1, 2, 3, 4}

   ^{Check the guide for self-hosting (including the built-in setup to deploy to GitHub Pages).}

... and it just works!

Feature Summary