Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

tox-dev/pyproject-api

              main @ 85fa191
            

Fixes

CVEs

HIGH

Peak severity

100.0%

Coverage

Highlights

Supply Chain / CI/CD: 3 prior fixes. Scrutinize any change in this area.

.github/workflows/check.yaml: most-fixed (3 issues). Treat as high-risk during review.

3 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Supply Chain / CI/CD: Cache poisoning via setup-uv's automatic caching on sensitive events can inject malicious toolchain artifacts into CI, leading to arbitrary code execution in privileged workflows.

Supply Chain / CI/CD: actions/checkout on pull_request_target/workflow_run can check out untrusted fork PRs, allowing attacker-controlled code to run with repository secrets.

Supply Chain / CI/CD: Unpinned actions and exposed credentials in workflows create a broad attack surface where a compromised action or leaked token can lead to full repository compromise.