Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

line/line-bot-sdk-python

              master @ c286e2d
            

Fixes

CVEs

HIGH

Peak severity

60.0%

Coverage

Highlights

Command Injection: 2 prior fixes. Scrutinize any change in this area.

.github/workflows/create-draft-release.yml: most-fixed (2 issues). Treat as high-risk during review.

4 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Command Injection: Two separate fixes were needed to eliminate shell injection in release-note handling, indicating a persistent pattern of passing untrusted content (release body/title) into shell commands.

Supply Chain: Mutable action tags (e.g. @v4) allow an attacker to alter the code executed in CI without detection; pinning to commit hashes is the only robust defense.

Supply Chain: Hardcoded long-lived PyPI tokens are a critical credential-theft risk; OIDC eliminates the standing secret.