Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
pymc-devs/pymc3
main @ da8fc47
3
Fixes
0
CVEs
HIGH
Peak severity
33.3%
Coverage
Highlights
Supply Chain Security: 2 prior fixes. Scrutinize any change in this area.
.github/workflows: most-fixed (1 issue). Treat as high-risk during review.
1 high-severity fix in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Supply Chain Security: Static PyPI token in release workflow could be exfiltrated, allowing malicious package publication. Replaced with OIDC trusted publishing.
Supply Chain Security: Workflow-level permissions were overly broad, enabling privilege escalation if a job was compromised. Tightened to least privilege.
Credential Leakage: Default persist-credentials=true in checkout leaves GitHub token in git config, risking leakage to subsequent steps. Disabled.