Security Rules

Rule	Severity	Description
Excessive GITHUB_TOKEN permissions	critical	Workflow uses permissions: write-all or does not restrict token scope. The GITHUB_TOKEN should follow least privilege — …
Potential hardcoded secret	critical	An environment variable name matches common secret patterns (API_KEY, TOKEN, PASSWORD, SECRET) and its value appears to …
pull_request_target with PR head checkout	critical	Workflow triggers on pull_request_target and checks out the PR head ref. This grants untrusted code access to repository…
Third-party action not pinned to SHA	high	A third-party action (not from actions/ or github/) is used without pinning to a full commit SHA. This is a supply-chain…
Long-lived cloud credentials instead of OIDC	medium	Workflow uses static cloud credentials (AWS_ACCESS_KEY_ID, etc.) stored as secrets instead of OIDC short-lived tokens.
Artifact uploaded without retention limit	medium	Job uploads artifacts without an explicit retention-days setting. GitHub Actions artifacts are publicly readable for 90 …