Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
Skyscanner/backpack-ios
main @ 64692cd
3
Fixes
0
CVEs
HIGH
Peak severity
0.0%
Coverage
Highlights
Credential Leakage: 1 prior fix. Scrutinize any change in this area.
GitHub: most-fixed (3 issues). Treat as high-risk during review.
1 high-severity fix in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Template Injection: Directly interpolating step outputs or context expressions into inline scripts allows external actors (e.g., via pull request payloads) to execute arbitrary commands inside the CI runner environment. Using environment variables is mandatory to isolate evaluation.
Privilege Escalation: Overly permissive default workflow-level permissions (GITHUB_TOKEN) and broad secrets inheritance allow compromised dependencies or steps to escalate privileges. Workflows should enforce minimum viable permissions explicitly.
Credential Leakage: Standard checkout actions persist git credentials in the local repository configuration by default, which can be harvested by subsequent build or test steps. Explicitly disabling credential persistence mitigates this exposure.