Use with caution. Address findings before production.
Scanned 5/3/2026, 6:44:47 PM·Cached result·Fast Scan·45 rules·How we decide ↗
AIVSS Score
Medium
Severity Breakdown
0
critical
2
high
66
medium
0
low
MCP Server Information
Findings
This package receives a C grade with a safety score of 48/100 due to 66 medium-severity issues, primarily centered on server configuration problems (49 findings) and hardcoded secrets (12 findings). The two high-severity findings, combined with risks around ANSI escape injection and insecure container images, indicate you should address these configuration and credential management issues before deployment. Installation is not recommended without remediation of the hardcoded secrets and server configuration vulnerabilities.
Scan Details
Want deeper analysis?
Fast scan found 68 findings using rule-based analysis. Upgrade for LLM consensus across 5 judges, AI-generated remediation, and cross-file taint analysis.
Building your own MCP server?
Same rules, same LLM judges, same grade. Private scans stay isolated to your account and never appear in the public registry. Required for code your team hasn’t shipped yet.
Showing 1–30 of 68 findings
68 findings
Unsafe deserialization primitive detected. pickle.load(s), yaml.load (without SafeLoader), marshal.load(s), and shelve.open execute arbitrary code when the input is attacker-controlled.
Evidence
| 75 | { accept: 'application/vnd.github.v3.raw' }, |
| 76 | ); |
| 77 | |
| 78 | const parsedWorkflow: WorkflowConfig = yaml.load( |
| 79 | workflowYaml, |
| 80 | ) as unknown as WorkflowConfig; |
| 81 | const inputs = parsedWorkflow.on?.workflow_dispatch?.inputs; |
Remediation
Replace pickle with json/msgpack or a schema-validated format (protobuf, cap'n proto). Use yaml.safe_load instead of yaml.load. Never deserialize data from an untrusted source with these APIs.
TLS certificate verification is disabled on an outbound HTTP client. Any MITM in the network path can intercept and modify requests / responses — credentials, tokens, and tool output flow over a channel with no integrity guarantee. Python requests / httpx: drop `verify=False`. If the peer is using a private CA, set `verify="/path/to/ca-bundle.pem"` or configure the system trust store. Node TS axios / fetch: drop `rejectUnauthorized: false` from the agent / `httpsAgent` options. Same private-CA
Evidence
| 8 | port: auth.port, |
| 9 | secure: auth.tls, |
| 10 | auth: { user: auth.username, pass: auth.password }, |
| 11 | tls: { rejectUnauthorized: false }, |
| 12 | logger: false, |
| 13 | connectionTimeout: 10000, |
| 14 | greetingTimeout: 7000, |
Remediation
Drop the verify-disable flag. If the peer presents a private CA: - Python: pass `verify="/path/to/ca.pem"` or trust the system store - Node: `new https.Agent({ ca: fs.readFileSync("ca.pem") })` - Go: load the CA via `x509.NewCertPool().AppendCertsFromPEM(...)` and set `tls.Config.RootCAs` Self-signed certificates: import the cert into the OS trust chain rather than disabling verification per-call.
Service binds to 0.0.0.0 — all network interfaces. For MCP servers that only need to talk to a single parent process, bind to 127.0.0.1 (or a Unix domain socket) instead.
Evidence
| 30 | const start = async (app: FastifyInstance): Promise<void> => { |
| 31 | try { |
| 32 | await app.listen({ |
| 33 | host: '0.0.0.0', |
| 34 | port: 3000, |
| 35 | }); |
| 36 | if (system.isWorker()) { |
Remediation
Bind to 127.0.0.1 for local-only access. If cross-host access is truly required, put the service behind an authenticated reverse proxy rather than exposing it on 0.0.0.0.
Service binds to 0.0.0.0 — all network interfaces. For MCP servers that only need to talk to a single parent process, bind to 127.0.0.1 (or a Unix domain socket) instead.
Evidence
| 88 | await app.register(engineController); |
| 89 | |
| 90 | await app.listen({ |
| 91 | host: '0.0.0.0', |
| 92 | port: 3005, |
| 93 | }); |
Remediation
Bind to 127.0.0.1 for local-only access. If cross-host access is truly required, put the service behind an authenticated reverse proxy rather than exposing it on 0.0.0.0.
User-controlled value printed to terminal without ANSI escape sanitization. Malicious input can inject cursor-control sequences, rewrite earlier output, or hide shell commands from the operator.
Evidence
| 80 | * This will override the default behavior of updating the order of the data items. |
| 81 | * @type (event: { activeIndex: number; overIndex: number }) => void |
| 82 | * @example |
| 83 | * onMove={(event) => console.log(`Item moved from index ${event.activeIndex} to index ${event.overIndex}`)} |
| 84 | */ |
| 85 | onMove?: (event: { activeIndex: number; overIndex: number }) => void; |
Remediation
Strip C0/C1 control codes before printing user-controlled values. Python: re.sub(r"[\x00-\x08\x0b-\x1f\x7f]", "", s). Prefer a structured logger (json/logfmt) over raw print to stdout.
User-controlled value printed to terminal without ANSI escape sanitization. Malicious input can inject cursor-control sequences, rewrite earlier output, or hide shell commands from the operator.
Evidence
| 293 | if (!clipboardText) { |
| 294 | // eslint-disable-next-line no-console |
| 295 | console.log('No data found in the clipboard event'); |
| 296 | copyPasteToast({ |
| 297 | success: false, |
| 298 | isCopy: false, |
Remediation
Strip C0/C1 control codes before printing user-controlled values. Python: re.sub(r"[\x00-\x08\x0b-\x1f\x7f]", "", s). Prefer a structured logger (json/logfmt) over raw print to stdout.
User-controlled value printed to terminal without ANSI escape sanitization. Malicious input can inject cursor-control sequences, rewrite earlier output, or hide shell commands from the operator.
Evidence
| 114 | {"type": "section", "text": {"type": "mrkdwn", "text": body_text}} |
| 115 | ] |
| 116 | } |
| 117 | print(json.dumps(payload)) |
| 118 | PY |
| 119 | |
| 120 | if curl --fail --silent --show-error -X POST -H 'Content-type: application/json' \ |
Remediation
Strip C0/C1 control codes before printing user-controlled values. Python: re.sub(r"[\x00-\x08\x0b-\x1f\x7f]", "", s). Prefer a structured logger (json/logfmt) over raw print to stdout.
MCP tool input schema exposes an unconstrained string/any field with a risky name (command/query/sql/code/script/url/path/expr/ eval). Any caller can pass arbitrary values, which typically widens the tool's blast radius well beyond its intent. Narrow the schema with `.enum()`, `.regex()`, `.max()`, `Literal[...]`, Pydantic `Field(max_length=..., pattern=...)`, or a JSON Schema `enum` / `pattern` / `maxLength`.
Evidence
| 7 | 'Mandatory text to the user. If code is generated, output text with a short code description; otherwise, if clarification is needed, ask the user; otherwise, output text explaining why no code was generated.'; |
| 8 | |
| 9 | export const codeLLMSchema = z.object({ |
| 10 | code: z.string().describe(codeDescription), |
| 11 | packageJson: z.string().describe(packageJsonDescription), |
| 12 | textAnswer: z.string().describe(textAnswerDescription), |
| 13 | type: z.literal('code'), |
Remediation
Shape the schema to the tool's actual intent: - Zod: chain `.enum([...])`, `.regex(/.../)`, or `.max(n)`; prefer `z.enum([...])` or `z.literal(...)` when the value set is small. - Pydantic: use `Literal["a", "b"]` or `Field(max_length=..., pattern=r"...")`. - JSON Schema: add `"enum"`, `"pattern"`, or `"maxLength"` to the property. An overbroad schema is an "overpowered tool" — the model has nothing to prevent it from calling the tool with input far beyond what the tool's prose contract
MCP tool input schema exposes an unconstrained string/any field with a risky name (command/query/sql/code/script/url/path/expr/ eval). Any caller can pass arbitrary values, which typically widens the tool's blast radius well beyond its intent. Narrow the schema with `.enum()`, `.regex()`, `.max()`, `Literal[...]`, Pydantic `Field(max_length=..., pattern=...)`, or a JSON Schema `enum` / `pattern` / `maxLength`.
Evidence
| 63 | - IMPORTANT: NEVER create or guess documentation URLs - only provide links that are explicitly returned by this tool |
| 64 | Use this tool to find accurate, verified information before answering OpenOps-specific questions.`, |
| 65 | inputSchema: z.object({ |
| 66 | query: z.string().describe('The search query'), |
| 67 | }), |
| 68 | execute: async ({ query }) => { |
| 69 | if (!searchTool?.execute) { |
Remediation
Shape the schema to the tool's actual intent: - Zod: chain `.enum([...])`, `.regex(/.../)`, or `.max(n)`; prefer `z.enum([...])` or `z.literal(...)` when the value set is small. - Pydantic: use `Literal["a", "b"]` or `Field(max_length=..., pattern=r"...")`. - JSON Schema: add `"enum"`, `"pattern"`, or `"maxLength"` to the property. An overbroad schema is an "overpowered tool" — the model has nothing to prevent it from calling the tool with input far beyond what the tool's prose contract
MCP tool input schema exposes an unconstrained string/any field with a risky name (command/query/sql/code/script/url/path/expr/ eval). Any caller can pass arbitrary values, which typically widens the tool's blast radius well beyond its intent. Narrow the schema with `.enum()`, `.regex()`, `.max()`, `Literal[...]`, Pydantic `Field(max_length=..., pattern=...)`, or a JSON Schema `enum` / `pattern` / `maxLength`.
Evidence
| 21 | .describe( |
| 22 | 'The type of the response. Always return "code" if you are generating code, and "reply" if you are answering the user question or asking for clarifications.', |
| 23 | ), |
| 24 | code: z.string().optional().describe(codeDescription), |
| 25 | packageJson: z.string().optional().describe(packageJsonDescription), |
| 26 | textAnswer: z.string().describe(textAnswerDescription), |
| 27 | }); |
Remediation
Shape the schema to the tool's actual intent: - Zod: chain `.enum([...])`, `.regex(/.../)`, or `.max(n)`; prefer `z.enum([...])` or `z.literal(...)` when the value set is small. - Pydantic: use `Literal["a", "b"]` or `Field(max_length=..., pattern=r"...")`. - JSON Schema: add `"enum"`, `"pattern"`, or `"maxLength"` to the property. An overbroad schema is an "overpowered tool" — the model has nothing to prevent it from calling the tool with input far beyond what the tool's prose contract
Package declares an install-time hook (npm postinstall/preinstall/prepare, setup.py cmdclass override, custom setuptools install class, or non-default pyproject build-backend). Anyone installing this package runs the hook. Confirm the hook is necessary and review its contents; prefer shipping a plain library without install-time execution.
Evidence
| 5 | "scripts": { |
| 6 | "setup:husky": "husky || true", |
| 7 | "setup:env": "[ ! -e .env ] && cp -v .env.template .env || :", |
| 8 | "prepare": "npm run setup:env && npm run setup:husky", |
| 9 | "serve:frontend": "nx serve react-ui", |
| 10 | "build:frontend": "nx build react-ui", |
| 11 | "serve:backend": "nx run server-api:serve:development", |
Remediation
Prefer libraries that do not require install-time code execution: - Drop `postinstall`/`preinstall`/`prepare` scripts if the work can happen at runtime or build-time instead. - Ship pre-built native binaries rather than compiling via a custom `cmdclass` or `build_ext` override. - For Dockerfiles: replace `RUN curl … | sh` with a pinned download + checksum verification + explicit `RUN` of a named script. - If the hook is unavoidable, document exactly what it does so downstream reviewers
Dockerfile never sets a non-root `USER` directive, so the CMD runs as root by default. Any RCE or library-level vulnerability exploited inside this container gets full privileges (MCP Top-10 R3). Add `USER <non-root>` before CMD / ENTRYPOINT in the final stage — e.g. `USER 1000`, `USER nobody`, or `USER nonroot` on distroless.
Evidence
| 1 | FROM node:20.19-alpine3.20 |
| 2 | |
| 3 | # Set the locale |
| 4 | ENV LANG=en_US.UTF-8 |
| 5 | ENV LANGUAGE=en_US:en |
| 6 | ENV LC_ALL=en_US.UTF-8 |
| 7 | ENV NODE_ENV=production |
| 8 | |
| 9 | # Use a cache mount for apt to speed up the process |
| 10 | RUN <<-``` |
| 11 | set -ex |
| 12 | apk add --no-cache openssh-client python3 g++ git musl libcap-dev nginx gettext wget py3-setuptools make bash findutils |
| 13 | yarn config set python /usr/bin/python3 |
| 14 | ``` |
| 15 | |
| 16 | WORKDIR /root/.mcp/openops-mcp |
| 17 | RUN <<-``` |
| 18 | set -ex |
| 19 | git clone https://github.com/openops-cloud/openops-mcp . |
| 20 | |
Remediation
Create and switch to a non-root user before the CMD / ENTRYPOINT: RUN adduser --system --uid 1000 app USER 1000 Or reuse the base image's shipped non-root account (e.g. `USER nobody`, `USER nonroot` on distroless). Multi-stage builds only need the USER directive in the final stage.
Dockerfile never sets a non-root `USER` directive, so the CMD runs as root by default. Any RCE or library-level vulnerability exploited inside this container gets full privileges (MCP Top-10 R3). Add `USER <non-root>` before CMD / ENTRYPOINT in the final stage — e.g. `USER 1000`, `USER nobody`, or `USER nonroot` on distroless.
Evidence
| 1 | ARG VARIANT=1.1.12-20-bullseye |
| 2 | FROM mcr.microsoft.com/vscode/devcontainers/javascript-node:${VARIANT} |
| 3 | |
| 4 | RUN <<-``` |
| 5 | npm install -g nx cross-env@7.0.3 |
| 6 | apt-get update && apt-get install -y --no-install-recommends \ |
| 7 | git \ |
| 8 | locales \ |
| 9 | locales-all \ |
| 10 | libcap-dev \ |
| 11 | wget \ |
| 12 | unzip |
| 13 | rm -rf /var/lib/apt/lists/* |
| 14 | ``` |
| 15 | |
| 16 | # Set the locale |
| 17 | ENV LANG en_US.UTF-8 |
| 18 | ENV LANGUAGE en_US:en |
| 19 | ENV LC_ALL en_US.UTF-8 |
| 20 | ENV AZURE_CONFIG_DIR="/tmp/azure" |
| 21 | ENV AZURE_EXTENSION_DIR="/opt/azure |
Remediation
Create and switch to a non-root user before the CMD / ENTRYPOINT: RUN adduser --system --uid 1000 app USER 1000 Or reuse the base image's shipped non-root account (e.g. `USER nobody`, `USER nonroot` on distroless). Multi-stage builds only need the USER directive in the final stage.
Dockerfile never sets a non-root `USER` directive, so the CMD runs as root by default. Any RCE or library-level vulnerability exploited inside this container gets full privileges (MCP Top-10 R3). Add `USER <non-root>` before CMD / ENTRYPOINT in the final stage — e.g. `USER 1000`, `USER nobody`, or `USER nonroot` on distroless.
Evidence
| 1 | FROM public.ecr.aws/lambda/nodejs:20 |
| 2 | |
| 3 | # Architecture will be set automatically by Docker buildx |
| 4 | ARG TARGETARCH |
| 5 | |
| 6 | ENV NODE_VERSION=20.18.0 |
| 7 | ENV NODE_ENV=production |
| 8 | |
| 9 | RUN <<-``` |
| 10 | set -ex |
| 11 | dnf install tar gzip shadow-utils util-linux findutils python3 make gcc gcc-c++ zlib-devel brotli-devel openssl-devel -y |
| 12 | dnf -y clean all && rm -rf /var/cache |
| 13 | |
| 14 | # Install YQ with architecture-specific binary |
| 15 | if [ "$TARGETARCH" = "arm64" ]; then |
| 16 | curl -L https://github.com/mikefarah/yq/release |
Remediation
Create and switch to a non-root user before the CMD / ENTRYPOINT: RUN adduser --system --uid 1000 app USER 1000 Or reuse the base image's shipped non-root account (e.g. `USER nobody`, `USER nonroot` on distroless). Multi-stage builds only need the USER directive in the final stage.
`.env` file contains a credential-like variable name (API_KEY / TOKEN / SECRET / PASSWORD / PRIVATE_KEY / BEARER) assigned to what looks like a real value. `.env` files ship inside `git archive`, `docker build` contexts, and install tarballs — any secret here leaks downstream (MCP Top-10 R9). Replace the value with a placeholder, rename the file to `.env.example`, and load the real value from a secret manager at runtime. If the credential was already committed, revoke it now (it is still in git
Evidence
| 24 | OPS_ENCRYPTION_KEY=abcdef123456789abcdef123456789ab |
| 25 | OPS_JWT_SECRET=please-change-this-secret |
| 26 | OPS_OPENOPS_ADMIN_EMAIL=admin@openops.com |
| 27 | OPS_OPENOPS_ADMIN_PASSWORD=please-change-this-password-1 |
| 28 | |
| 29 | |
| 30 | # --------------------------------------------------------- |
Remediation
Remove the credential from the `.env` file and replace with a template placeholder: OPENAI_API_KEY=<your-openai-key> OPENAI_API_KEY=${OPENAI_API_KEY} Rename the file to `.env.example` so humans know it is a template. Store the real value in a secret manager and inject it at runtime. If the credential has already been committed, revoke it immediately (git history still contains it).
`.env` file contains a credential-like variable name (API_KEY / TOKEN / SECRET / PASSWORD / PRIVATE_KEY / BEARER) assigned to what looks like a real value. `.env` files ship inside `git archive`, `docker build` contexts, and install tarballs — any secret here leaks downstream (MCP Top-10 R9). Replace the value with a placeholder, rename the file to `.env.example`, and load the real value from a secret manager at runtime. If the credential was already committed, revoke it now (it is still in git
Evidence
| 14 | OPS_CACHE_PATH=./dev/cache |
| 15 | OPS_EDITION=cloud |
| 16 | OPS_BLOCKS_SOURCE=DB |
| 17 | OPS_JWT_SECRET=secret |
| 18 | OPS_BILLING_SETTINGS={\"nickname\":\"test-flow-plan\",\"tasks\":1000,\"activeFlows\":20,\"minimumPollingInterval\":5,\"connections\":50,\"teamMembers\":1,\"type\":\"FLOWS\"} |
| 19 | OPS_STRIPE_SECRET_KEY=invalid-key |
| 20 | OPS_FIREBASE_HASH_PARAMETERS={\"memCost\":14,\"rounds\":8,\"signerKey\":\"YE0dO4bwD4JnJafh6lZZfkp1MtKzuKAXQcDCJNJNyeCHairWHKENOkbh3dzwaCdizzOspwr/FITUVlnOAwPKyw==\",\"saltSeparator\":\"Bw==\"} |
Remediation
Remove the credential from the `.env` file and replace with a template placeholder: OPENAI_API_KEY=<your-openai-key> OPENAI_API_KEY=${OPENAI_API_KEY} Rename the file to `.env.example` so humans know it is a template. Store the real value in a secret manager and inject it at runtime. If the credential has already been committed, revoke it immediately (git history still contains it).
`.env` file contains a credential-like variable name (API_KEY / TOKEN / SECRET / PASSWORD / PRIVATE_KEY / BEARER) assigned to what looks like a real value. `.env` files ship inside `git archive`, `docker build` contexts, and install tarballs — any secret here leaks downstream (MCP Top-10 R9). Replace the value with a placeholder, rename the file to `.env.example`, and load the real value from a secret manager at runtime. If the credential was already committed, revoke it now (it is still in git
Evidence
| 75 | OPS_OPENOPS_TABLES_DATABASE_NAME=tables |
| 76 | OPS_OPENOPS_TABLES_API_URL=http://openops-tables |
| 77 | OPS_OPENOPS_TABLES_PUBLIC_URL=${OPS_PUBLIC_URL} |
| 78 | OPS_TABLES_TOKEN_LIFETIME_MINUTES=60 |
| 79 | OPS_JWT_TOKEN_LIFETIME_HOURS=168 |
| 80 | OPS_MAX_CONCURRENT_TABLES_REQUESTS=100 |
Remediation
Remove the credential from the `.env` file and replace with a template placeholder: OPENAI_API_KEY=<your-openai-key> OPENAI_API_KEY=${OPENAI_API_KEY} Rename the file to `.env.example` so humans know it is a template. Store the real value in a secret manager and inject it at runtime. If the credential has already been committed, revoke it immediately (git history still contains it).
`.env` file contains a credential-like variable name (API_KEY / TOKEN / SECRET / PASSWORD / PRIVATE_KEY / BEARER) assigned to what looks like a real value. `.env` files ship inside `git archive`, `docker build` contexts, and install tarballs — any secret here leaks downstream (MCP Top-10 R9). Replace the value with a placeholder, rename the file to `.env.example`, and load the real value from a secret manager at runtime. If the credential was already committed, revoke it now (it is still in git
Evidence
| 23 | OPS_CONTAINER_TYPE=WORKER_AND_APP |
| 24 | OPS_ENGINE_URL=http://localhost:3005/execute |
| 25 | OPS_OPENOPS_ADMIN_EMAIL=local-admin@openops.com |
| 26 | OPS_OPENOPS_ADMIN_PASSWORD=12345678 |
| 27 | OPS_OPENOPS_TABLES_PUBLIC_URL=http://localhost:3001 |
| 28 | OPS_ANALYTICS_ENABLED=true |
Remediation
Remove the credential from the `.env` file and replace with a template placeholder: OPENAI_API_KEY=<your-openai-key> OPENAI_API_KEY=${OPENAI_API_KEY} Rename the file to `.env.example` so humans know it is a template. Store the real value in a secret manager and inject it at runtime. If the credential has already been committed, revoke it immediately (git history still contains it).
`.env` file contains a credential-like variable name (API_KEY / TOKEN / SECRET / PASSWORD / PRIVATE_KEY / BEARER) assigned to what looks like a real value. `.env` files ship inside `git archive`, `docker build` contexts, and install tarballs — any secret here leaks downstream (MCP Top-10 R9). Replace the value with a placeholder, rename the file to `.env.example`, and load the real value from a secret manager at runtime. If the credential was already committed, revoke it now (it is still in git
Evidence
| 86 | OPS_ANALYTICS_ENABLED=true |
| 87 | OPS_ANALYTICS_PUBLIC_URL=${OPS_PUBLIC_URL} |
| 88 | OPS_ANALYTICS_PRIVATE_URL=http://openops-analytics:8088 |
| 89 | OPS_ANALYTICS_ADMIN_PASSWORD=please-change-this-password-1 |
| 90 | ANALYTICS_POWERUSER_PASSWORD=please-change-this-password-1 |
| 91 | ANALYTICS_ALLOW_ADHOC_SUBQUERY=true |
Remediation
Remove the credential from the `.env` file and replace with a template placeholder: OPENAI_API_KEY=<your-openai-key> OPENAI_API_KEY=${OPENAI_API_KEY} Rename the file to `.env.example` so humans know it is a template. Store the real value in a secret manager and inject it at runtime. If the credential has already been committed, revoke it immediately (git history still contains it).
`.env` file contains a credential-like variable name (API_KEY / TOKEN / SECRET / PASSWORD / PRIVATE_KEY / BEARER) assigned to what looks like a real value. `.env` files ship inside `git archive`, `docker build` contexts, and install tarballs — any secret here leaks downstream (MCP Top-10 R9). Replace the value with a placeholder, rename the file to `.env.example`, and load the real value from a secret manager at runtime. If the credential was already committed, revoke it now (it is still in git
Evidence
| 16 | OPS_BLOCKS_SOURCE=DB |
| 17 | OPS_JWT_SECRET=secret |
| 18 | OPS_BILLING_SETTINGS={\"nickname\":\"test-flow-plan\",\"tasks\":1000,\"activeFlows\":20,\"minimumPollingInterval\":5,\"connections\":50,\"teamMembers\":1,\"type\":\"FLOWS\"} |
| 19 | OPS_STRIPE_SECRET_KEY=invalid-key |
| 20 | OPS_FIREBASE_HASH_PARAMETERS={\"memCost\":14,\"rounds\":8,\"signerKey\":\"YE0dO4bwD4JnJafh6lZZfkp1MtKzuKAXQcDCJNJNyeCHairWHKENOkbh3dzwaCdizzOspwr/FITUVlnOAwPKyw==\",\"saltSeparator\":\"Bw==\"} |
| 21 | OPS_CLOUD_ORGANIZATION_ID="cloud-id" |
| 22 | OPS_BLOCKS_SYNC_MOD |
Remediation
Remove the credential from the `.env` file and replace with a template placeholder: OPENAI_API_KEY=<your-openai-key> OPENAI_API_KEY=${OPENAI_API_KEY} Rename the file to `.env.example` so humans know it is a template. Store the real value in a secret manager and inject it at runtime. If the credential has already been committed, revoke it immediately (git history still contains it).
`.env` file contains a credential-like variable name (API_KEY / TOKEN / SECRET / PASSWORD / PRIVATE_KEY / BEARER) assigned to what looks like a real value. `.env` files ship inside `git archive`, `docker build` contexts, and install tarballs — any secret here leaks downstream (MCP Top-10 R9). Replace the value with a placeholder, rename the file to `.env.example`, and load the real value from a secret manager at runtime. If the credential was already committed, revoke it now (it is still in git
Evidence
| 87 | OPS_ANALYTICS_PUBLIC_URL=${OPS_PUBLIC_URL} |
| 88 | OPS_ANALYTICS_PRIVATE_URL=http://openops-analytics:8088 |
| 89 | OPS_ANALYTICS_ADMIN_PASSWORD=please-change-this-password-1 |
| 90 | ANALYTICS_POWERUSER_PASSWORD=please-change-this-password-1 |
| 91 | ANALYTICS_ALLOW_ADHOC_SUBQUERY=true |
Remediation
Remove the credential from the `.env` file and replace with a template placeholder: OPENAI_API_KEY=<your-openai-key> OPENAI_API_KEY=${OPENAI_API_KEY} Rename the file to `.env.example` so humans know it is a template. Store the real value in a secret manager and inject it at runtime. If the credential has already been committed, revoke it immediately (git history still contains it).
`.env` file contains a credential-like variable name (API_KEY / TOKEN / SECRET / PASSWORD / PRIVATE_KEY / BEARER) assigned to what looks like a real value. `.env` files ship inside `git archive`, `docker build` contexts, and install tarballs — any secret here leaks downstream (MCP Top-10 R9). Replace the value with a placeholder, rename the file to `.env.example`, and load the real value from a secret manager at runtime. If the credential was already committed, revoke it now (it is still in git
Evidence
| 96 | # --------------------------------------------------------- |
| 97 | |
| 98 | # Slack |
| 99 | OPS_SLACK_APP_SIGNING_SECRET= |
| 100 | |
| 101 | # Cloud Provider CLIs |
| 102 | OPS_ENABLE_HOST_SESSION= |
| 103 | |
| 104 | # AWS |
Remediation
Remove the credential from the `.env` file and replace with a template placeholder: OPENAI_API_KEY=<your-openai-key> OPENAI_API_KEY=${OPENAI_API_KEY} Rename the file to `.env.example` so humans know it is a template. Store the real value in a secret manager and inject it at runtime. If the credential has already been committed, revoke it immediately (git history still contains it).
`.env` file contains a credential-like variable name (API_KEY / TOKEN / SECRET / PASSWORD / PRIVATE_KEY / BEARER) assigned to what looks like a real value. `.env` files ship inside `git archive`, `docker build` contexts, and install tarballs — any secret here leaks downstream (MCP Top-10 R9). Replace the value with a placeholder, rename the file to `.env.example`, and load the real value from a secret manager at runtime. If the credential was already committed, revoke it now (it is still in git
Evidence
| 30 | # --------------------------------------------------------- |
| 31 | # Telemetry |
| 32 | # --------------------------------------------------------- |
| 33 | |
| 34 | OPS_LOGZIO_TOKEN= |
| 35 | OPS_LOGZIO_METRICS_TOKEN= |
| 36 | OPS_LOG_LEVEL=info |
| 37 | OPS_LOG_PRETTY=false |
| 38 | OPS_TELEMETRY_MODE=COLLECTOR |
Remediation
Remove the credential from the `.env` file and replace with a template placeholder: OPENAI_API_KEY=<your-openai-key> OPENAI_API_KEY=${OPENAI_API_KEY} Rename the file to `.env.example` so humans know it is a template. Store the real value in a secret manager and inject it at runtime. If the credential has already been committed, revoke it immediately (git history still contains it).
`.env` file contains a credential-like variable name (API_KEY / TOKEN / SECRET / PASSWORD / PRIVATE_KEY / BEARER) assigned to what looks like a real value. `.env` files ship inside `git archive`, `docker build` contexts, and install tarballs — any secret here leaks downstream (MCP Top-10 R9). Replace the value with a placeholder, rename the file to `.env.example`, and load the real value from a secret manager at runtime. If the credential was already committed, revoke it now (it is still in git
Evidence
| 76 | OPS_OPENOPS_TABLES_API_URL=http://openops-tables |
| 77 | OPS_OPENOPS_TABLES_PUBLIC_URL=${OPS_PUBLIC_URL} |
| 78 | OPS_TABLES_TOKEN_LIFETIME_MINUTES=60 |
| 79 | OPS_JWT_TOKEN_LIFETIME_HOURS=168 |
| 80 | OPS_MAX_CONCURRENT_TABLES_REQUESTS=100 |
| 81 | |
| 82 | # --------------------------------------------------------- |
Remediation
Remove the credential from the `.env` file and replace with a template placeholder: OPENAI_API_KEY=<your-openai-key> OPENAI_API_KEY=${OPENAI_API_KEY} Rename the file to `.env.example` so humans know it is a template. Store the real value in a secret manager and inject it at runtime. If the credential has already been committed, revoke it immediately (git history still contains it).
`.env` file contains a credential-like variable name (API_KEY / TOKEN / SECRET / PASSWORD / PRIVATE_KEY / BEARER) assigned to what looks like a real value. `.env` files ship inside `git archive`, `docker build` contexts, and install tarballs — any secret here leaks downstream (MCP Top-10 R9). Replace the value with a placeholder, rename the file to `.env.example`, and load the real value from a secret manager at runtime. If the credential was already committed, revoke it now (it is still in git
Evidence
| 63 | OPS_DB_TYPE=POSTGRES |
| 64 | OPS_POSTGRES_DATABASE=openops |
| 65 | OPS_POSTGRES_HOST=postgres |
| 66 | OPS_POSTGRES_PASSWORD=please-change-this-password-1 |
| 67 | OPS_POSTGRES_PORT=5432 |
| 68 | OPS_POSTGRES_USERNAME=postgres |
| 69 | OPS_OPENOPS_TABLES_DB_HOST=postgres |
Remediation
Remove the credential from the `.env` file and replace with a template placeholder: OPENAI_API_KEY=<your-openai-key> OPENAI_API_KEY=${OPENAI_API_KEY} Rename the file to `.env.example` so humans know it is a template. Store the real value in a secret manager and inject it at runtime. If the credential has already been committed, revoke it immediately (git history still contains it).
`.env` file contains a credential-like variable name (API_KEY / TOKEN / SECRET / PASSWORD / PRIVATE_KEY / BEARER) assigned to what looks like a real value. `.env` files ship inside `git archive`, `docker build` contexts, and install tarballs — any secret here leaks downstream (MCP Top-10 R9). Replace the value with a placeholder, rename the file to `.env.example`, and load the real value from a secret manager at runtime. If the credential was already committed, revoke it now (it is still in git
Evidence
| 22 | # --------------------------------------------------------- |
| 23 | |
| 24 | OPS_ENCRYPTION_KEY=abcdef123456789abcdef123456789ab |
| 25 | OPS_JWT_SECRET=please-change-this-secret |
| 26 | OPS_OPENOPS_ADMIN_EMAIL=admin@openops.com |
| 27 | OPS_OPENOPS_ADMIN_PASSWORD=please-change-this-password-1 |
Remediation
Remove the credential from the `.env` file and replace with a template placeholder: OPENAI_API_KEY=<your-openai-key> OPENAI_API_KEY=${OPENAI_API_KEY} Rename the file to `.env.example` so humans know it is a template. Store the real value in a secret manager and inject it at runtime. If the credential has already been committed, revoke it immediately (git history still contains it).
GitHub Actions `uses:` reference is not pinned to a 40-character commit SHA. Tags (`@v4`) and branches (`@main`) are mutable — a compromised maintainer or a tag rewrite can substitute malicious code into your CI pipeline silently. Pin to a SHA: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab`. For readability, include the version as a trailing comment: `# v4.1.1`. Tools like `pinact` / `ratchet` automate this. Allowed unpinned forms (excluded by the rule): - Local actions `.
Evidence
| 77 | steps: |
| 78 | - name: Checkout for Dependabot PR |
| 79 | if: ${{ startsWith(github.head_ref || '', 'dependabot/') }} |
| 80 | uses: actions/checkout@v6.0.2 |
| 81 | with: |
| 82 | ref: ${{ github.head_ref }} |
| 83 | - name: Checkout for others |
Remediation
Pin every `uses:` to a 40-character commit SHA. Trailing comment with the version helps reviewers: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` Automate the migration with `pinact` (https://github.com/suzuki-shunsuke/pinact) or `ratchet` (https://github.com/sethvargo/ratchet). Add a `pinact run --check` pre-commit hook so future PRs stay pinned. Re-pin when the action releases a new version — Dependabot can do this automatically with `version-update-strategy: inc
GitHub Actions `uses:` reference is not pinned to a 40-character commit SHA. Tags (`@v4`) and branches (`@main`) are mutable — a compromised maintainer or a tag rewrite can substitute malicious code into your CI pipeline silently. Pin to a SHA: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab`. For readability, include the version as a trailing comment: `# v4.1.1`. Tools like `pinact` / `ratchet` automate this. Allowed unpinned forms (excluded by the rule): - Local actions `.
Evidence
| 138 | key: node-modules-cache-${{ hashFiles('package-lock.json', '.npmrc') }} |
| 139 | fail-on-cache-miss: true |
| 140 | - name: Restore NX cache |
| 141 | uses: actions/cache@v5.0.4 |
| 142 | with: |
| 143 | path: .nx/cache |
| 144 | key: nx-test-${{ matrix.test-suits.key || matrix.test-suits.name }}-${{ github.sha }} |
Remediation
Pin every `uses:` to a 40-character commit SHA. Trailing comment with the version helps reviewers: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` Automate the migration with `pinact` (https://github.com/suzuki-shunsuke/pinact) or `ratchet` (https://github.com/sethvargo/ratchet). Add a `pinact run --check` pre-commit hook so future PRs stay pinned. Re-pin when the action releases a new version — Dependabot can do this automatically with `version-update-strategy: inc
GitHub Actions `uses:` reference is not pinned to a 40-character commit SHA. Tags (`@v4`) and branches (`@main`) are mutable — a compromised maintainer or a tag rewrite can substitute malicious code into your CI pipeline silently. Pin to a SHA: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab`. For readability, include the version as a trailing comment: `# v4.1.1`. Tools like `pinact` / `ratchet` automate this. Allowed unpinned forms (excluded by the rule): - Local actions `.
Evidence
| 31 | needs: install |
| 32 | runs-on: ubuntu-latest |
| 33 | steps: |
| 34 | - uses: actions/checkout@v6.0.2 |
| 35 | - name: Restore node_modules cache |
| 36 | id: node-modules-cache |
| 37 | uses: actions/cache/restore@v5.0.4 |
Remediation
Pin every `uses:` to a 40-character commit SHA. Trailing comment with the version helps reviewers: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` Automate the migration with `pinact` (https://github.com/suzuki-shunsuke/pinact) or `ratchet` (https://github.com/sethvargo/ratchet). Add a `pinact run --check` pre-commit hook so future PRs stay pinned. Re-pin when the action releases a new version — Dependabot can do this automatically with `version-update-strategy: inc
GitHub Actions `uses:` reference is not pinned to a 40-character commit SHA. Tags (`@v4`) and branches (`@main`) are mutable — a compromised maintainer or a tag rewrite can substitute malicious code into your CI pipeline silently. Pin to a SHA: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab`. For readability, include the version as a trailing comment: `# v4.1.1`. Tools like `pinact` / `ratchet` automate this. Allowed unpinned forms (excluded by the rule): - Local actions `.
Evidence
| 133 | steps: |
| 134 | - name: Get GitHub App token |
| 135 | id: app_token |
| 136 | uses: actions/create-github-app-token@v3.0.0 |
| 137 | with: |
| 138 | app-id: ${{ vars.DEVOPS_GITHUB_APP_ID }} |
| 139 | private-key: ${{ secrets.DEVOPS_GITHUB_APP_PEM }} |
Remediation
Pin every `uses:` to a 40-character commit SHA. Trailing comment with the version helps reviewers: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` Automate the migration with `pinact` (https://github.com/suzuki-shunsuke/pinact) or `ratchet` (https://github.com/sethvargo/ratchet). Add a `pinact run --check` pre-commit hook so future PRs stay pinned. Re-pin when the action releases a new version — Dependabot can do this automatically with `version-update-strategy: inc
GitHub Actions `uses:` reference is not pinned to a 40-character commit SHA. Tags (`@v4`) and branches (`@main`) are mutable — a compromised maintainer or a tag rewrite can substitute malicious code into your CI pipeline silently. Pin to a SHA: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab`. For readability, include the version as a trailing comment: `# v4.1.1`. Tools like `pinact` / `ratchet` automate this. Allowed unpinned forms (excluded by the rule): - Local actions `.
Evidence
| 132 | - uses: actions/checkout@v6.0.2 |
| 133 | - name: Restore node_modules cache |
| 134 | id: node-modules-cache |
| 135 | uses: actions/cache/restore@v5.0.4 |
| 136 | with: |
| 137 | path: node_modules |
| 138 | key: node-modules-cache-${{ hashFiles('package-lock.json', '.npmrc') }} |
Remediation
Pin every `uses:` to a 40-character commit SHA. Trailing comment with the version helps reviewers: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` Automate the migration with `pinact` (https://github.com/suzuki-shunsuke/pinact) or `ratchet` (https://github.com/sethvargo/ratchet). Add a `pinact run --check` pre-commit hook so future PRs stay pinned. Re-pin when the action releases a new version — Dependabot can do this automatically with `version-update-strategy: inc
GitHub Actions `uses:` reference is not pinned to a 40-character commit SHA. Tags (`@v4`) and branches (`@main`) are mutable — a compromised maintainer or a tag rewrite can substitute malicious code into your CI pipeline silently. Pin to a SHA: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab`. For readability, include the version as a trailing comment: `# v4.1.1`. Tools like `pinact` / `ratchet` automate this. Allowed unpinned forms (excluded by the rule): - Local actions `.
Evidence
| 85 | uses: actions/checkout@v6.0.2 |
| 86 | - name: Restore node_modules cache |
| 87 | id: node-modules-cache |
| 88 | uses: actions/cache/restore@v5.0.4 |
| 89 | with: |
| 90 | path: node_modules |
| 91 | key: node-modules-cache-${{ hashFiles('package-lock.json', '.npmrc') }} |
Remediation
Pin every `uses:` to a 40-character commit SHA. Trailing comment with the version helps reviewers: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` Automate the migration with `pinact` (https://github.com/suzuki-shunsuke/pinact) or `ratchet` (https://github.com/sethvargo/ratchet). Add a `pinact run --check` pre-commit hook so future PRs stay pinned. Re-pin when the action releases a new version — Dependabot can do this automatically with `version-update-strategy: inc
GitHub Actions `uses:` reference is not pinned to a 40-character commit SHA. Tags (`@v4`) and branches (`@main`) are mutable — a compromised maintainer or a tag rewrite can substitute malicious code into your CI pipeline silently. Pin to a SHA: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab`. For readability, include the version as a trailing comment: `# v4.1.1`. Tools like `pinact` / `ratchet` automate this. Allowed unpinned forms (excluded by the rule): - Local actions `.
Evidence
| 165 | - uses: actions/checkout@v6.0.2 |
| 166 | - name: Restore node_modules cache |
| 167 | id: node-modules-cache |
| 168 | uses: actions/cache/restore@v5.0.4 |
| 169 | with: |
| 170 | path: node_modules |
| 171 | key: node-modules-cache-${{ hashFiles('package-lock.json', '.npmrc') }} |
Remediation
Pin every `uses:` to a 40-character commit SHA. Trailing comment with the version helps reviewers: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` Automate the migration with `pinact` (https://github.com/suzuki-shunsuke/pinact) or `ratchet` (https://github.com/sethvargo/ratchet). Add a `pinact run --check` pre-commit hook so future PRs stay pinned. Re-pin when the action releases a new version — Dependabot can do this automatically with `version-update-strategy: inc
GitHub Actions `uses:` reference is not pinned to a 40-character commit SHA. Tags (`@v4`) and branches (`@main`) are mutable — a compromised maintainer or a tag rewrite can substitute malicious code into your CI pipeline silently. Pin to a SHA: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab`. For readability, include the version as a trailing comment: `# v4.1.1`. Tools like `pinact` / `ratchet` automate this. Allowed unpinned forms (excluded by the rule): - Local actions `.
Evidence
| 203 | needs: build |
| 204 | runs-on: ${{ matrix.platform == 'amd64' && 'ubuntu-latest' || 'ubuntu-arm64' }} |
| 205 | steps: |
| 206 | - uses: actions/checkout@v6.0.2 |
| 207 | - name: Restore build cache |
| 208 | uses: actions/cache/restore@v5.0.4 |
| 209 | with: |
Remediation
Pin every `uses:` to a 40-character commit SHA. Trailing comment with the version helps reviewers: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` Automate the migration with `pinact` (https://github.com/suzuki-shunsuke/pinact) or `ratchet` (https://github.com/sethvargo/ratchet). Add a `pinact run --check` pre-commit hook so future PRs stay pinned. Re-pin when the action releases a new version — Dependabot can do this automatically with `version-update-strategy: inc
GitHub Actions `uses:` reference is not pinned to a 40-character commit SHA. Tags (`@v4`) and branches (`@main`) are mutable — a compromised maintainer or a tag rewrite can substitute malicious code into your CI pipeline silently. Pin to a SHA: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab`. For readability, include the version as a trailing comment: `# v4.1.1`. Tools like `pinact` / `ratchet` automate this. Allowed unpinned forms (excluded by the rule): - Local actions `.
Evidence
| 34 | - uses: actions/checkout@v6.0.2 |
| 35 | - name: Restore node_modules cache |
| 36 | id: node-modules-cache |
| 37 | uses: actions/cache/restore@v5.0.4 |
| 38 | with: |
| 39 | path: node_modules |
| 40 | key: node-modules-cache-${{ hashFiles('package-lock.json', '.npmrc') }} |
Remediation
Pin every `uses:` to a 40-character commit SHA. Trailing comment with the version helps reviewers: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` Automate the migration with `pinact` (https://github.com/suzuki-shunsuke/pinact) or `ratchet` (https://github.com/sethvargo/ratchet). Add a `pinact run --check` pre-commit hook so future PRs stay pinned. Re-pin when the action releases a new version — Dependabot can do this automatically with `version-update-strategy: inc
GitHub Actions `uses:` reference is not pinned to a 40-character commit SHA. Tags (`@v4`) and branches (`@main`) are mutable — a compromised maintainer or a tag rewrite can substitute malicious code into your CI pipeline silently. Pin to a SHA: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab`. For readability, include the version as a trailing comment: `# v4.1.1`. Tools like `pinact` / `ratchet` automate this. Allowed unpinned forms (excluded by the rule): - Local actions `.
Evidence
| 18 | NODE_OPTIONS: --max-old-space-size=4096 |
| 19 | steps: |
| 20 | - name: Checkout code |
| 21 | uses: actions/checkout@v6.0.2 |
| 22 | with: |
| 23 | fetch-depth: 0 |
Remediation
Pin every `uses:` to a 40-character commit SHA. Trailing comment with the version helps reviewers: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` Automate the migration with `pinact` (https://github.com/suzuki-shunsuke/pinact) or `ratchet` (https://github.com/sethvargo/ratchet). Add a `pinact run --check` pre-commit hook so future PRs stay pinned. Re-pin when the action releases a new version — Dependabot can do this automatically with `version-update-strategy: inc
GitHub Actions `uses:` reference is not pinned to a 40-character commit SHA. Tags (`@v4`) and branches (`@main`) are mutable — a compromised maintainer or a tag rewrite can substitute malicious code into your CI pipeline silently. Pin to a SHA: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab`. For readability, include the version as a trailing comment: `# v4.1.1`. Tools like `pinact` / `ratchet` automate this. Allowed unpinned forms (excluded by the rule): - Local actions `.
Evidence
| 278 | aws-region: ${{ vars.ECR_REGION }} |
| 279 | - name: Login to Amazon ECR |
| 280 | id: login-ecr |
| 281 | uses: aws-actions/amazon-ecr-login@v2.1.0 |
| 282 | - name: Format image tag components |
| 283 | env: |
| 284 | BRANCH: ${{ github.head_ref || github.ref_name }} |
Remediation
Pin every `uses:` to a 40-character commit SHA. Trailing comment with the version helps reviewers: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` Automate the migration with `pinact` (https://github.com/suzuki-shunsuke/pinact) or `ratchet` (https://github.com/sethvargo/ratchet). Add a `pinact run --check` pre-commit hook so future PRs stay pinned. Re-pin when the action releases a new version — Dependabot can do this automatically with `version-update-strategy: inc
GitHub Actions `uses:` reference is not pinned to a 40-character commit SHA. Tags (`@v4`) and branches (`@main`) are mutable — a compromised maintainer or a tag rewrite can substitute malicious code into your CI pipeline silently. Pin to a SHA: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab`. For readability, include the version as a trailing comment: `# v4.1.1`. Tools like `pinact` / `ratchet` automate this. Allowed unpinned forms (excluded by the rule): - Local actions `.
Evidence
| 271 | needs: build-images |
| 272 | steps: |
| 273 | - name: Configure AWS credentials |
| 274 | uses: aws-actions/configure-aws-credentials@v6.0.0 |
| 275 | with: |
| 276 | aws-access-key-id: ${{ secrets.ECR_ACCESS_KEY_ID }} |
| 277 | aws-secret-access-key: ${{ secrets.ECR_SECRET_ACCESS_KEY }} |
Remediation
Pin every `uses:` to a 40-character commit SHA. Trailing comment with the version helps reviewers: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` Automate the migration with `pinact` (https://github.com/suzuki-shunsuke/pinact) or `ratchet` (https://github.com/sethvargo/ratchet). Add a `pinact run --check` pre-commit hook so future PRs stay pinned. Re-pin when the action releases a new version — Dependabot can do this automatically with `version-update-strategy: inc
GitHub Actions `uses:` reference is not pinned to a 40-character commit SHA. Tags (`@v4`) and branches (`@main`) are mutable — a compromised maintainer or a tag rewrite can substitute malicious code into your CI pipeline silently. Pin to a SHA: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab`. For readability, include the version as a trailing comment: `# v4.1.1`. Tools like `pinact` / `ratchet` automate this. Allowed unpinned forms (excluded by the rule): - Local actions `.
Evidence
| 46 | needs: install |
| 47 | runs-on: ubuntu-latest |
| 48 | steps: |
| 49 | - uses: actions/checkout@v6.0.2 |
| 50 | - name: Restore node_modules cache |
| 51 | id: node-modules-cache |
| 52 | uses: actions/cache/restore@v5.0.4 |
Remediation
Pin every `uses:` to a 40-character commit SHA. Trailing comment with the version helps reviewers: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` Automate the migration with `pinact` (https://github.com/suzuki-shunsuke/pinact) or `ratchet` (https://github.com/sethvargo/ratchet). Add a `pinact run --check` pre-commit hook so future PRs stay pinned. Re-pin when the action releases a new version — Dependabot can do this automatically with `version-update-strategy: inc
GitHub Actions `uses:` reference is not pinned to a 40-character commit SHA. Tags (`@v4`) and branches (`@main`) are mutable — a compromised maintainer or a tag rewrite can substitute malicious code into your CI pipeline silently. Pin to a SHA: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab`. For readability, include the version as a trailing comment: `# v4.1.1`. Tools like `pinact` / `ratchet` automate this. Allowed unpinned forms (excluded by the rule): - Local actions `.
Evidence
| 109 | echo "The release was created as a draft." >> $GITHUB_STEP_SUMMARY |
| 110 | echo "Please [review and publish it](${RELEASE_URL/\/tags\//\/edit\/})." >> $GITHUB_STEP_SUMMARY |
| 111 | - name: Configure AWS credentials |
| 112 | uses: aws-actions/configure-aws-credentials@v6.0.0 |
| 113 | with: |
| 114 | aws-access-key-id: ${{ secrets.RELEASE_S3_ACCESS_KEY_ID }} |
| 115 | aws-secret-access-key: ${{ secrets.RELEASE_S3_SECRET_ACCESS_KEY }} |
Remediation
Pin every `uses:` to a 40-character commit SHA. Trailing comment with the version helps reviewers: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` Automate the migration with `pinact` (https://github.com/suzuki-shunsuke/pinact) or `ratchet` (https://github.com/sethvargo/ratchet). Add a `pinact run --check` pre-commit hook so future PRs stay pinned. Re-pin when the action releases a new version — Dependabot can do this automatically with `version-update-strategy: inc
GitHub Actions `uses:` reference is not pinned to a 40-character commit SHA. Tags (`@v4`) and branches (`@main`) are mutable — a compromised maintainer or a tag rewrite can substitute malicious code into your CI pipeline silently. Pin to a SHA: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab`. For readability, include the version as a trailing comment: `# v4.1.1`. Tools like `pinact` / `ratchet` automate this. Allowed unpinned forms (excluded by the rule): - Local actions `.
Evidence
| 17 | - uses: actions/checkout@v6.0.2 |
| 18 | - name: Lookup node_modules cache |
| 19 | id: node-modules-cache |
| 20 | uses: actions/cache@v5.0.4 |
| 21 | with: |
| 22 | path: node_modules |
| 23 | key: node-modules-cache-${{ hashFiles('package-lock.json', '.npmrc') }} |
Remediation
Pin every `uses:` to a 40-character commit SHA. Trailing comment with the version helps reviewers: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` Automate the migration with `pinact` (https://github.com/suzuki-shunsuke/pinact) or `ratchet` (https://github.com/sethvargo/ratchet). Add a `pinact run --check` pre-commit hook so future PRs stay pinned. Re-pin when the action releases a new version — Dependabot can do this automatically with `version-update-strategy: inc
GitHub Actions `uses:` reference is not pinned to a 40-character commit SHA. Tags (`@v4`) and branches (`@main`) are mutable — a compromised maintainer or a tag rewrite can substitute malicious code into your CI pipeline silently. Pin to a SHA: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab`. For readability, include the version as a trailing comment: `# v4.1.1`. Tools like `pinact` / `ratchet` automate this. Allowed unpinned forms (excluded by the rule): - Local actions `.
Evidence
| 205 | steps: |
| 206 | - uses: actions/checkout@v6.0.2 |
| 207 | - name: Restore build cache |
| 208 | uses: actions/cache/restore@v5.0.4 |
| 209 | with: |
| 210 | path: dist |
| 211 | key: dist-${{ github.sha }} |
Remediation
Pin every `uses:` to a 40-character commit SHA. Trailing comment with the version helps reviewers: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` Automate the migration with `pinact` (https://github.com/suzuki-shunsuke/pinact) or `ratchet` (https://github.com/sethvargo/ratchet). Add a `pinact run --check` pre-commit hook so future PRs stay pinned. Re-pin when the action releases a new version — Dependabot can do this automatically with `version-update-strategy: inc
GitHub Actions `uses:` reference is not pinned to a 40-character commit SHA. Tags (`@v4`) and branches (`@main`) are mutable — a compromised maintainer or a tag rewrite can substitute malicious code into your CI pipeline silently. Pin to a SHA: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab`. For readability, include the version as a trailing comment: `# v4.1.1`. Tools like `pinact` / `ratchet` automate this. Allowed unpinned forms (excluded by the rule): - Local actions `.
Evidence
| 154 | steps: |
| 155 | - name: Get token from Github App |
| 156 | id: app_token |
| 157 | uses: actions/create-github-app-token@v3.0.0 |
| 158 | with: |
| 159 | app-id: ${{ vars.DEVOPS_GITHUB_APP_ID }} |
| 160 | private-key: ${{ secrets.DEVOPS_GITHUB_APP_PEM }} |
Remediation
Pin every `uses:` to a 40-character commit SHA. Trailing comment with the version helps reviewers: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` Automate the migration with `pinact` (https://github.com/suzuki-shunsuke/pinact) or `ratchet` (https://github.com/sethvargo/ratchet). Add a `pinact run --check` pre-commit hook so future PRs stay pinned. Re-pin when the action releases a new version — Dependabot can do this automatically with `version-update-strategy: inc
GitHub Actions `uses:` reference is not pinned to a 40-character commit SHA. Tags (`@v4`) and branches (`@main`) are mutable — a compromised maintainer or a tag rewrite can substitute malicious code into your CI pipeline silently. Pin to a SHA: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab`. For readability, include the version as a trailing comment: `# v4.1.1`. Tools like `pinact` / `ratchet` automate this. Allowed unpinned forms (excluded by the rule): - Local actions `.
Evidence
| 55 | id: login-private-ecr |
| 56 | uses: aws-actions/amazon-ecr-login@v2.1.0 |
| 57 | - name: Login to public ECR |
| 58 | uses: aws-actions/amazon-ecr-login@v2.1.0 |
| 59 | env: |
| 60 | AWS_REGION: ${{ vars.ECR_PUBLIC_REGION }} |
| 61 | with: |
Remediation
Pin every `uses:` to a 40-character commit SHA. Trailing comment with the version helps reviewers: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` Automate the migration with `pinact` (https://github.com/suzuki-shunsuke/pinact) or `ratchet` (https://github.com/sethvargo/ratchet). Add a `pinact run --check` pre-commit hook so future PRs stay pinned. Re-pin when the action releases a new version — Dependabot can do this automatically with `version-update-strategy: inc
GitHub Actions `uses:` reference is not pinned to a 40-character commit SHA. Tags (`@v4`) and branches (`@main`) are mutable — a compromised maintainer or a tag rewrite can substitute malicious code into your CI pipeline silently. Pin to a SHA: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab`. For readability, include the version as a trailing comment: `# v4.1.1`. Tools like `pinact` / `ratchet` automate this. Allowed unpinned forms (excluded by the rule): - Local actions `.
Evidence
| 24 | - name: Cache node_modules |
| 25 | id: node-modules-cache |
| 26 | uses: actions/cache@v5.0.4 |
| 27 | with: |
| 28 | path: node_modules |
| 29 | key: node-modules-cache-${{ hashFiles('package-lock.json', '.npmrc') }} |
Remediation
Pin every `uses:` to a 40-character commit SHA. Trailing comment with the version helps reviewers: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` Automate the migration with `pinact` (https://github.com/suzuki-shunsuke/pinact) or `ratchet` (https://github.com/sethvargo/ratchet). Add a `pinact run --check` pre-commit hook so future PRs stay pinned. Re-pin when the action releases a new version — Dependabot can do this automatically with `version-update-strategy: inc
GitHub Actions `uses:` reference is not pinned to a 40-character commit SHA. Tags (`@v4`) and branches (`@main`) are mutable — a compromised maintainer or a tag rewrite can substitute malicious code into your CI pipeline silently. Pin to a SHA: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab`. For readability, include the version as a trailing comment: `# v4.1.1`. Tools like `pinact` / `ratchet` automate this. Allowed unpinned forms (excluded by the rule): - Local actions `.
Evidence
| 11 | steps: |
| 12 | - name: Get token from Github App |
| 13 | id: app_token |
| 14 | uses: actions/create-github-app-token@v3.0.0 |
| 15 | with: |
| 16 | app-id: ${{ vars.DEVOPS_GITHUB_APP_ID }} |
| 17 | private-key: ${{ secrets.DEVOPS_GITHUB_APP_PEM }} |
Remediation
Pin every `uses:` to a 40-character commit SHA. Trailing comment with the version helps reviewers: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` Automate the migration with `pinact` (https://github.com/suzuki-shunsuke/pinact) or `ratchet` (https://github.com/sethvargo/ratchet). Add a `pinact run --check` pre-commit hook so future PRs stay pinned. Re-pin when the action releases a new version — Dependabot can do this automatically with `version-update-strategy: inc
GitHub Actions `uses:` reference is not pinned to a 40-character commit SHA. Tags (`@v4`) and branches (`@main`) are mutable — a compromised maintainer or a tag rewrite can substitute malicious code into your CI pipeline silently. Pin to a SHA: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab`. For readability, include the version as a trailing comment: `# v4.1.1`. Tools like `pinact` / `ratchet` automate this. Allowed unpinned forms (excluded by the rule): - Local actions `.
Evidence
| 129 | needs: install |
| 130 | runs-on: ubuntu-latest |
| 131 | steps: |
| 132 | - uses: actions/checkout@v6.0.2 |
| 133 | - name: Restore node_modules cache |
| 134 | id: node-modules-cache |
| 135 | uses: actions/cache/restore@v5.0.4 |
Remediation
Pin every `uses:` to a 40-character commit SHA. Trailing comment with the version helps reviewers: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` Automate the migration with `pinact` (https://github.com/suzuki-shunsuke/pinact) or `ratchet` (https://github.com/sethvargo/ratchet). Add a `pinact run --check` pre-commit hook so future PRs stay pinned. Re-pin when the action releases a new version — Dependabot can do this automatically with `version-update-strategy: inc
GitHub Actions `uses:` reference is not pinned to a 40-character commit SHA. Tags (`@v4`) and branches (`@main`) are mutable — a compromised maintainer or a tag rewrite can substitute malicious code into your CI pipeline silently. Pin to a SHA: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab`. For readability, include the version as a trailing comment: `# v4.1.1`. Tools like `pinact` / `ratchet` automate this. Allowed unpinned forms (excluded by the rule): - Local actions `.
Evidence
| 14 | name: Install Dependencies |
| 15 | runs-on: ubuntu-latest |
| 16 | steps: |
| 17 | - uses: actions/checkout@v6.0.2 |
| 18 | - name: Lookup node_modules cache |
| 19 | id: node-modules-cache |
| 20 | uses: actions/cache@v5.0.4 |
Remediation
Pin every `uses:` to a 40-character commit SHA. Trailing comment with the version helps reviewers: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` Automate the migration with `pinact` (https://github.com/suzuki-shunsuke/pinact) or `ratchet` (https://github.com/sethvargo/ratchet). Add a `pinact run --check` pre-commit hook so future PRs stay pinned. Re-pin when the action releases a new version — Dependabot can do this automatically with `version-update-strategy: inc
GitHub Actions `uses:` reference is not pinned to a 40-character commit SHA. Tags (`@v4`) and branches (`@main`) are mutable — a compromised maintainer or a tag rewrite can substitute malicious code into your CI pipeline silently. Pin to a SHA: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab`. For readability, include the version as a trailing comment: `# v4.1.1`. Tools like `pinact` / `ratchet` automate this. Allowed unpinned forms (excluded by the rule): - Local actions `.
Evidence
| 82 | ref: ${{ github.head_ref }} |
| 83 | - name: Checkout for others |
| 84 | if: ${{ !startsWith(github.head_ref || '', 'dependabot/') }} |
| 85 | uses: actions/checkout@v6.0.2 |
| 86 | - name: Restore node_modules cache |
| 87 | id: node-modules-cache |
| 88 | uses: actions/cache/restore@v5.0.4 |
Remediation
Pin every `uses:` to a 40-character commit SHA. Trailing comment with the version helps reviewers: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` Automate the migration with `pinact` (https://github.com/suzuki-shunsuke/pinact) or `ratchet` (https://github.com/sethvargo/ratchet). Add a `pinact run --check` pre-commit hook so future PRs stay pinned. Re-pin when the action releases a new version — Dependabot can do this automatically with `version-update-strategy: inc
GitHub Actions `uses:` reference is not pinned to a 40-character commit SHA. Tags (`@v4`) and branches (`@main`) are mutable — a compromised maintainer or a tag rewrite can substitute malicious code into your CI pipeline silently. Pin to a SHA: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab`. For readability, include the version as a trailing comment: `# v4.1.1`. Tools like `pinact` / `ratchet` automate this. Allowed unpinned forms (excluded by the rule): - Local actions `.
Evidence
| 214 | uses: docker/setup-buildx-action@v4.0.0 |
| 215 | - name: Configure AWS credentials |
| 216 | if: vars.ECR_REGION |
| 217 | uses: aws-actions/configure-aws-credentials@v6.0.0 |
| 218 | with: |
| 219 | aws-access-key-id: ${{ secrets.ECR_ACCESS_KEY_ID }} |
| 220 | aws-secret-access-key: ${{ secrets.ECR_SECRET_ACCESS_KEY }} |
Remediation
Pin every `uses:` to a 40-character commit SHA. Trailing comment with the version helps reviewers: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` Automate the migration with `pinact` (https://github.com/suzuki-shunsuke/pinact) or `ratchet` (https://github.com/sethvargo/ratchet). Add a `pinact run --check` pre-commit hook so future PRs stay pinned. Re-pin when the action releases a new version — Dependabot can do this automatically with `version-update-strategy: inc
GitHub Actions `uses:` reference is not pinned to a 40-character commit SHA. Tags (`@v4`) and branches (`@main`) are mutable — a compromised maintainer or a tag rewrite can substitute malicious code into your CI pipeline silently. Pin to a SHA: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab`. For readability, include the version as a trailing comment: `# v4.1.1`. Tools like `pinact` / `ratchet` automate this. Allowed unpinned forms (excluded by the rule): - Local actions `.
Evidence
| 252 | cache-to: mode=max,image-manifest=true,oci-mediatypes=true,type=registry,ref=${{ env.REPOSITORY_URI }}:${{ env.SANITIZED_BRANCH }}-${{ matrix.platform }}-cache |
| 253 | - name: Build image |
| 254 | if: ${{ !vars.ECR_REGION }} |
| 255 | uses: docker/build-push-action@v7.0.0 |
| 256 | with: |
| 257 | context: . |
| 258 | file: ./${{ matrix.target.file }} |
Remediation
Pin every `uses:` to a 40-character commit SHA. Trailing comment with the version helps reviewers: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` Automate the migration with `pinact` (https://github.com/suzuki-shunsuke/pinact) or `ratchet` (https://github.com/sethvargo/ratchet). Add a `pinact run --check` pre-commit hook so future PRs stay pinned. Re-pin when the action releases a new version — Dependabot can do this automatically with `version-update-strategy: inc
GitHub Actions `uses:` reference is not pinned to a 40-character commit SHA. Tags (`@v4`) and branches (`@main`) are mutable — a compromised maintainer or a tag rewrite can substitute malicious code into your CI pipeline silently. Pin to a SHA: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab`. For readability, include the version as a trailing comment: `# v4.1.1`. Tools like `pinact` / `ratchet` automate this. Allowed unpinned forms (excluded by the rule): - Local actions `.
Evidence
| 46 | - name: Set up Docker Buildx |
| 47 | uses: docker/setup-buildx-action@v4.0.0 |
| 48 | - name: Configure AWS credentials |
| 49 | uses: aws-actions/configure-aws-credentials@v6.0.0 |
| 50 | with: |
| 51 | aws-access-key-id: ${{ secrets.ECR_ACCESS_KEY_ID }} |
| 52 | aws-secret-access-key: ${{ secrets.ECR_SECRET_ACCESS_KEY }} |
Remediation
Pin every `uses:` to a 40-character commit SHA. Trailing comment with the version helps reviewers: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` Automate the migration with `pinact` (https://github.com/suzuki-shunsuke/pinact) or `ratchet` (https://github.com/sethvargo/ratchet). Add a `pinact run --check` pre-commit hook so future PRs stay pinned. Re-pin when the action releases a new version — Dependabot can do this automatically with `version-update-strategy: inc
GitHub Actions `uses:` reference is not pinned to a 40-character commit SHA. Tags (`@v4`) and branches (`@main`) are mutable — a compromised maintainer or a tag rewrite can substitute malicious code into your CI pipeline silently. Pin to a SHA: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab`. For readability, include the version as a trailing comment: `# v4.1.1`. Tools like `pinact` / `ratchet` automate this. Allowed unpinned forms (excluded by the rule): - Local actions `.
Evidence
| 84 | VERSION: ${{ needs.get-version.outputs.version }} |
| 85 | RELEASE_DC_FILENAME: openops-dc-${{ needs.get-version.outputs.version }}.zip |
| 86 | steps: |
| 87 | - uses: actions/checkout@v6.0.2 |
| 88 | - name: Create a release file |
| 89 | run: | |
| 90 | cp THIRD_PARTY_LICENSES.txt LICENSE NOTICE deploy/docker-compose |
Remediation
Pin every `uses:` to a 40-character commit SHA. Trailing comment with the version helps reviewers: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` Automate the migration with `pinact` (https://github.com/suzuki-shunsuke/pinact) or `ratchet` (https://github.com/sethvargo/ratchet). Add a `pinact run --check` pre-commit hook so future PRs stay pinned. Re-pin when the action releases a new version — Dependabot can do this automatically with `version-update-strategy: inc
GitHub Actions `uses:` reference is not pinned to a 40-character commit SHA. Tags (`@v4`) and branches (`@main`) are mutable — a compromised maintainer or a tag rewrite can substitute malicious code into your CI pipeline silently. Pin to a SHA: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab`. For readability, include the version as a trailing comment: `# v4.1.1`. Tools like `pinact` / `ratchet` automate this. Allowed unpinned forms (excluded by the rule): - Local actions `.
Evidence
| 53 | aws-region: ${{ vars.ECR_REGION }} |
| 54 | - name: Login to private ECR |
| 55 | id: login-private-ecr |
| 56 | uses: aws-actions/amazon-ecr-login@v2.1.0 |
| 57 | - name: Login to public ECR |
| 58 | uses: aws-actions/amazon-ecr-login@v2.1.0 |
| 59 | env: |
Remediation
Pin every `uses:` to a 40-character commit SHA. Trailing comment with the version helps reviewers: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` Automate the migration with `pinact` (https://github.com/suzuki-shunsuke/pinact) or `ratchet` (https://github.com/sethvargo/ratchet). Add a `pinact run --check` pre-commit hook so future PRs stay pinned. Re-pin when the action releases a new version — Dependabot can do this automatically with `version-update-strategy: inc
GitHub Actions `uses:` reference is not pinned to a 40-character commit SHA. Tags (`@v4`) and branches (`@main`) are mutable — a compromised maintainer or a tag rewrite can substitute malicious code into your CI pipeline silently. Pin to a SHA: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab`. For readability, include the version as a trailing comment: `# v4.1.1`. Tools like `pinact` / `ratchet` automate this. Allowed unpinned forms (excluded by the rule): - Local actions `.
Evidence
| 21 | runs-on: ubuntu-latest |
| 22 | steps: |
| 23 | - id: stale |
| 24 | uses: actions/stale@v10 |
| 25 | with: |
| 26 | debug-only: ${{ (github.event_name == 'workflow_dispatch' && github.event.inputs['dry-run'] == 'true') || 'false' }} |
Remediation
Pin every `uses:` to a 40-character commit SHA. Trailing comment with the version helps reviewers: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` Automate the migration with `pinact` (https://github.com/suzuki-shunsuke/pinact) or `ratchet` (https://github.com/sethvargo/ratchet). Add a `pinact run --check` pre-commit hook so future PRs stay pinned. Re-pin when the action releases a new version — Dependabot can do this automatically with `version-update-strategy: inc
GitHub Actions `uses:` reference is not pinned to a 40-character commit SHA. Tags (`@v4`) and branches (`@main`) are mutable — a compromised maintainer or a tag rewrite can substitute malicious code into your CI pipeline silently. Pin to a SHA: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab`. For readability, include the version as a trailing comment: `# v4.1.1`. Tools like `pinact` / `ratchet` automate this. Allowed unpinned forms (excluded by the rule): - Local actions `.
Evidence
| 36 | - name: Run Chromatic |
| 37 | if: env.CHROMATIC_PROJECT_TOKEN |
| 38 | uses: chromaui/action@v16.0.0 |
| 39 | with: |
| 40 | projectToken: ${{ secrets.CHROMATIC_PROJECT_TOKEN }} |
| 41 | onlyChanged: true # 👈 Required option to enable TurboSnap |
Remediation
Pin every `uses:` to a 40-character commit SHA. Trailing comment with the version helps reviewers: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` Automate the migration with `pinact` (https://github.com/suzuki-shunsuke/pinact) or `ratchet` (https://github.com/sethvargo/ratchet). Add a `pinact run --check` pre-commit hook so future PRs stay pinned. Re-pin when the action releases a new version — Dependabot can do this automatically with `version-update-strategy: inc
GitHub Actions `uses:` reference is not pinned to a 40-character commit SHA. Tags (`@v4`) and branches (`@main`) are mutable — a compromised maintainer or a tag rewrite can substitute malicious code into your CI pipeline silently. Pin to a SHA: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab`. For readability, include the version as a trailing comment: `# v4.1.1`. Tools like `pinact` / `ratchet` automate this. Allowed unpinned forms (excluded by the rule): - Local actions `.
Evidence
| 175 | steps: |
| 176 | - name: Get GitHub App token |
| 177 | id: app_token |
| 178 | uses: actions/create-github-app-token@v3.0.0 |
| 179 | with: |
| 180 | app-id: ${{ vars.DEVOPS_GITHUB_APP_ID }} |
| 181 | private-key: ${{ secrets.DEVOPS_GITHUB_APP_PEM }} |
Remediation
Pin every `uses:` to a 40-character commit SHA. Trailing comment with the version helps reviewers: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` Automate the migration with `pinact` (https://github.com/suzuki-shunsuke/pinact) or `ratchet` (https://github.com/sethvargo/ratchet). Add a `pinact run --check` pre-commit hook so future PRs stay pinned. Re-pin when the action releases a new version — Dependabot can do this automatically with `version-update-strategy: inc
GitHub Actions `uses:` reference is not pinned to a 40-character commit SHA. Tags (`@v4`) and branches (`@main`) are mutable — a compromised maintainer or a tag rewrite can substitute malicious code into your CI pipeline silently. Pin to a SHA: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab`. For readability, include the version as a trailing comment: `# v4.1.1`. Tools like `pinact` / `ratchet` automate this. Allowed unpinned forms (excluded by the rule): - Local actions `.
Evidence
| 184 | npx nx run-many --target=build |
| 185 | ./tools/truncate-nx-cache.sh |
| 186 | - name: Save build cache |
| 187 | uses: actions/cache/save@v5.0.4 |
| 188 | with: |
| 189 | path: dist |
| 190 | key: dist-${{ github.sha }} |
Remediation
Pin every `uses:` to a 40-character commit SHA. Trailing comment with the version helps reviewers: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` Automate the migration with `pinact` (https://github.com/suzuki-shunsuke/pinact) or `ratchet` (https://github.com/sethvargo/ratchet). Add a `pinact run --check` pre-commit hook so future PRs stay pinned. Re-pin when the action releases a new version — Dependabot can do this automatically with `version-update-strategy: inc
GitHub Actions `uses:` reference is not pinned to a 40-character commit SHA. Tags (`@v4`) and branches (`@main`) are mutable — a compromised maintainer or a tag rewrite can substitute malicious code into your CI pipeline silently. Pin to a SHA: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab`. For readability, include the version as a trailing comment: `# v4.1.1`. Tools like `pinact` / `ratchet` automate this. Allowed unpinned forms (excluded by the rule): - Local actions `.
Evidence
| 44 | VERSION: ${{ needs.get-version.outputs.version }} |
| 45 | steps: |
| 46 | - name: Set up Docker Buildx |
| 47 | uses: docker/setup-buildx-action@v4.0.0 |
| 48 | - name: Configure AWS credentials |
| 49 | uses: aws-actions/configure-aws-credentials@v6.0.0 |
| 50 | with: |
Remediation
Pin every `uses:` to a 40-character commit SHA. Trailing comment with the version helps reviewers: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` Automate the migration with `pinact` (https://github.com/suzuki-shunsuke/pinact) or `ratchet` (https://github.com/sethvargo/ratchet). Add a `pinact run --check` pre-commit hook so future PRs stay pinned. Re-pin when the action releases a new version — Dependabot can do this automatically with `version-update-strategy: inc
GitHub Actions `uses:` reference is not pinned to a 40-character commit SHA. Tags (`@v4`) and branches (`@main`) are mutable — a compromised maintainer or a tag rewrite can substitute malicious code into your CI pipeline silently. Pin to a SHA: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab`. For readability, include the version as a trailing comment: `# v4.1.1`. Tools like `pinact` / `ratchet` automate this. Allowed unpinned forms (excluded by the rule): - Local actions `.
Evidence
| 15 | steps: |
| 16 | - name: Get token from Github App |
| 17 | id: app_token |
| 18 | uses: actions/create-github-app-token@v3.0.0 |
| 19 | with: |
| 20 | app-id: ${{ vars.DEVOPS_GITHUB_APP_ID }} |
| 21 | private-key: ${{ secrets.DEVOPS_GITHUB_APP_PEM }} |
Remediation
Pin every `uses:` to a 40-character commit SHA. Trailing comment with the version helps reviewers: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` Automate the migration with `pinact` (https://github.com/suzuki-shunsuke/pinact) or `ratchet` (https://github.com/sethvargo/ratchet). Add a `pinact run --check` pre-commit hook so future PRs stay pinned. Re-pin when the action releases a new version — Dependabot can do this automatically with `version-update-strategy: inc
GitHub Actions `uses:` reference is not pinned to a 40-character commit SHA. Tags (`@v4`) and branches (`@main`) are mutable — a compromised maintainer or a tag rewrite can substitute malicious code into your CI pipeline silently. Pin to a SHA: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab`. For readability, include the version as a trailing comment: `# v4.1.1`. Tools like `pinact` / `ratchet` automate this. Allowed unpinned forms (excluded by the rule): - Local actions `.
Evidence
| 171 | key: node-modules-cache-${{ hashFiles('package-lock.json', '.npmrc') }} |
| 172 | fail-on-cache-miss: true |
| 173 | - name: Restore NX cache |
| 174 | uses: actions/cache@v5.0.4 |
| 175 | with: |
| 176 | path: .nx/cache |
| 177 | key: nx-build-${{ github.sha }} |
Remediation
Pin every `uses:` to a 40-character commit SHA. Trailing comment with the version helps reviewers: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` Automate the migration with `pinact` (https://github.com/suzuki-shunsuke/pinact) or `ratchet` (https://github.com/sethvargo/ratchet). Add a `pinact run --check` pre-commit hook so future PRs stay pinned. Re-pin when the action releases a new version — Dependabot can do this automatically with `version-update-strategy: inc
GitHub Actions `uses:` reference is not pinned to a 40-character commit SHA. Tags (`@v4`) and branches (`@main`) are mutable — a compromised maintainer or a tag rewrite can substitute malicious code into your CI pipeline silently. Pin to a SHA: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab`. For readability, include the version as a trailing comment: `# v4.1.1`. Tools like `pinact` / `ratchet` automate this. Allowed unpinned forms (excluded by the rule): - Local actions `.
Evidence
| 162 | needs: install |
| 163 | runs-on: ubuntu-latest |
| 164 | steps: |
| 165 | - uses: actions/checkout@v6.0.2 |
| 166 | - name: Restore node_modules cache |
| 167 | id: node-modules-cache |
| 168 | uses: actions/cache/restore@v5.0.4 |
Remediation
Pin every `uses:` to a 40-character commit SHA. Trailing comment with the version helps reviewers: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` Automate the migration with `pinact` (https://github.com/suzuki-shunsuke/pinact) or `ratchet` (https://github.com/sethvargo/ratchet). Add a `pinact run --check` pre-commit hook so future PRs stay pinned. Re-pin when the action releases a new version — Dependabot can do this automatically with `version-update-strategy: inc
GitHub Actions `uses:` reference is not pinned to a 40-character commit SHA. Tags (`@v4`) and branches (`@main`) are mutable — a compromised maintainer or a tag rewrite can substitute malicious code into your CI pipeline silently. Pin to a SHA: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab`. For readability, include the version as a trailing comment: `# v4.1.1`. Tools like `pinact` / `ratchet` automate this. Allowed unpinned forms (excluded by the rule): - Local actions `.
Evidence
| 94 | - name: Create a GitHub release |
| 95 | id: create-github-release |
| 96 | if: inputs.github_release |
| 97 | uses: softprops/action-gh-release@v2.6.1 |
| 98 | with: |
| 99 | target_commitish: ${{ github.sha }} |
| 100 | tag_name: ${{ env.VERSION }} |
Remediation
Pin every `uses:` to a 40-character commit SHA. Trailing comment with the version helps reviewers: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` Automate the migration with `pinact` (https://github.com/suzuki-shunsuke/pinact) or `ratchet` (https://github.com/sethvargo/ratchet). Add a `pinact run --check` pre-commit hook so future PRs stay pinned. Re-pin when the action releases a new version — Dependabot can do this automatically with `version-update-strategy: inc
GitHub Actions `uses:` reference is not pinned to a 40-character commit SHA. Tags (`@v4`) and branches (`@main`) are mutable — a compromised maintainer or a tag rewrite can substitute malicious code into your CI pipeline silently. Pin to a SHA: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab`. For readability, include the version as a trailing comment: `# v4.1.1`. Tools like `pinact` / `ratchet` automate this. Allowed unpinned forms (excluded by the rule): - Local actions `.
Evidence
| 49 | - uses: actions/checkout@v6.0.2 |
| 50 | - name: Restore node_modules cache |
| 51 | id: node-modules-cache |
| 52 | uses: actions/cache/restore@v5.0.4 |
| 53 | with: |
| 54 | path: node_modules |
| 55 | key: node-modules-cache-${{ hashFiles('package-lock.json', '.npmrc') }} |
Remediation
Pin every `uses:` to a 40-character commit SHA. Trailing comment with the version helps reviewers: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` Automate the migration with `pinact` (https://github.com/suzuki-shunsuke/pinact) or `ratchet` (https://github.com/sethvargo/ratchet). Add a `pinact run --check` pre-commit hook so future PRs stay pinned. Re-pin when the action releases a new version — Dependabot can do this automatically with `version-update-strategy: inc
GitHub Actions `uses:` reference is not pinned to a 40-character commit SHA. Tags (`@v4`) and branches (`@main`) are mutable — a compromised maintainer or a tag rewrite can substitute malicious code into your CI pipeline silently. Pin to a SHA: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab`. For readability, include the version as a trailing comment: `# v4.1.1`. Tools like `pinact` / `ratchet` automate this. Allowed unpinned forms (excluded by the rule): - Local actions `.
Evidence
| 55 | key: node-modules-cache-${{ hashFiles('package-lock.json', '.npmrc') }} |
| 56 | fail-on-cache-miss: true |
| 57 | - name: Restore NX cache |
| 58 | uses: actions/cache@v5.0.4 |
| 59 | with: |
| 60 | path: .nx/cache |
| 61 | key: nx-lint-${{ github.sha }} |
Remediation
Pin every `uses:` to a 40-character commit SHA. Trailing comment with the version helps reviewers: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` Automate the migration with `pinact` (https://github.com/suzuki-shunsuke/pinact) or `ratchet` (https://github.com/sethvargo/ratchet). Add a `pinact run --check` pre-commit hook so future PRs stay pinned. Re-pin when the action releases a new version — Dependabot can do this automatically with `version-update-strategy: inc
GitHub Actions `uses:` reference is not pinned to a 40-character commit SHA. Tags (`@v4`) and branches (`@main`) are mutable — a compromised maintainer or a tag rewrite can substitute malicious code into your CI pipeline silently. Pin to a SHA: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab`. For readability, include the version as a trailing comment: `# v4.1.1`. Tools like `pinact` / `ratchet` automate this. Allowed unpinned forms (excluded by the rule): - Local actions `.
Evidence
| 211 | key: dist-${{ github.sha }} |
| 212 | fail-on-cache-miss: true |
| 213 | - name: Set up Docker Buildx |
| 214 | uses: docker/setup-buildx-action@v4.0.0 |
| 215 | - name: Configure AWS credentials |
| 216 | if: vars.ECR_REGION |
| 217 | uses: aws-actions/configure-aws-credentials@v6.0.0 |
Remediation
Pin every `uses:` to a 40-character commit SHA. Trailing comment with the version helps reviewers: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` Automate the migration with `pinact` (https://github.com/suzuki-shunsuke/pinact) or `ratchet` (https://github.com/sethvargo/ratchet). Add a `pinact run --check` pre-commit hook so future PRs stay pinned. Re-pin when the action releases a new version — Dependabot can do this automatically with `version-update-strategy: inc
GitHub Actions `uses:` reference is not pinned to a 40-character commit SHA. Tags (`@v4`) and branches (`@main`) are mutable — a compromised maintainer or a tag rewrite can substitute malicious code into your CI pipeline silently. Pin to a SHA: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab`. For readability, include the version as a trailing comment: `# v4.1.1`. Tools like `pinact` / `ratchet` automate this. Allowed unpinned forms (excluded by the rule): - Local actions `.
Evidence
| 234 | echo SHORT_SHA=${SHA::8} >> "$GITHUB_ENV" |
| 235 | - name: Build image |
| 236 | if: vars.ECR_REGION |
| 237 | uses: docker/build-push-action@v7.0.0 |
| 238 | with: |
| 239 | context: . |
| 240 | file: ./${{ matrix.target.file }} |
Remediation
Pin every `uses:` to a 40-character commit SHA. Trailing comment with the version helps reviewers: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` Automate the migration with `pinact` (https://github.com/suzuki-shunsuke/pinact) or `ratchet` (https://github.com/sethvargo/ratchet). Add a `pinact run --check` pre-commit hook so future PRs stay pinned. Re-pin when the action releases a new version — Dependabot can do this automatically with `version-update-strategy: inc
GitHub Actions `uses:` reference is not pinned to a 40-character commit SHA. Tags (`@v4`) and branches (`@main`) are mutable — a compromised maintainer or a tag rewrite can substitute malicious code into your CI pipeline silently. Pin to a SHA: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab`. For readability, include the version as a trailing comment: `# v4.1.1`. Tools like `pinact` / `ratchet` automate this. Allowed unpinned forms (excluded by the rule): - Local actions `.
Evidence
| 222 | - name: Login to Amazon ECR |
| 223 | id: login-ecr |
| 224 | if: vars.ECR_REGION |
| 225 | uses: aws-actions/amazon-ecr-login@v2.1.0 |
| 226 | - name: Format image tag parts |
| 227 | env: |
| 228 | BRANCH: ${{ github.head_ref || github.ref_name }} |
Remediation
Pin every `uses:` to a 40-character commit SHA. Trailing comment with the version helps reviewers: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` Automate the migration with `pinact` (https://github.com/suzuki-shunsuke/pinact) or `ratchet` (https://github.com/sethvargo/ratchet). Add a `pinact run --check` pre-commit hook so future PRs stay pinned. Re-pin when the action releases a new version — Dependabot can do this automatically with `version-update-strategy: inc