TAINTLY REPORT

Repository: /snapshot/repoPlatform: githubGenerated: 2026-01-01T00:00:00

Executive summary

distinct risks

review-needed

total findings

files scanned

CRITICAL 1 HIGH 1 MEDIUM 1 LOW 2

Quick win

CRITICAL SEC3-GH-001: Action referenced by mutable tag auto-fixable via --fix

Location: .github/workflows/ci.yml:12

Fix: Pin the action to a full 40-character commit SHA.

Top distinct risks (4)

CRITICALexpl:highMutable dependency references1 finding · 1 file

Actions, reusable workflows, and includes referenced by tag or branch can be force-pushed to point at different code without any record in your repository's history. Pin every external dependency to a full 40-char commit SHA.

Rules: SEC3-GH-001

Sev	Rule	Location	Title
CRITICAL	`SEC3-GH-001`	.github/workflows/ci.yml:12	Action referenced by mutable tag

HIGHexpl:highAgent Credential Chain1 finding · 1 file

Rules: PSE-GH-001

Sev	Rule	Location	Title
HIGH	`PSE-GH-001`	.github/workflows/agent.yml:24	AI agent with cloud-credential grant on a fork-reachable event

MEDIUMExcessive Permissions1 finding · 1 file

Rules: SEC2-GH-002

Sev	Rule	Location	Title
MEDIUM	`SEC2-GH-002`	.github/workflows/ci.yml:1	Missing top-level permissions block

LOWFile size 60000 bytes exceeds scanner cap (50000)1 finding · 1 file

Rules: ENGINE-ERR

Sev	Rule	Location	Title
LOW	`ENGINE-ERR`	.github/workflows/big.yml:0	File size 60000 bytes exceeds scanner cap (50000)

Review-needed patterns (1)

LOWTaint To Run Block1 finding · 1 file

Rules: TAINT-GH-001

Sev	Rule	Location	Title
LOW	`TAINT-GH-001`	.github/workflows/ci.yml:42	Possible taint flow

All findings (5)

Show flat list of every finding

Sev	Rule	Location	Title
CRITICAL	`SEC3-GH-001`	`.github/workflows/ci.yml:12`	Action referenced by mutable tag
HIGH	`PSE-GH-001`	`.github/workflows/agent.yml:24`	AI agent with cloud-credential grant on a fork-reachable event
MEDIUM	`SEC2-GH-002`	`.github/workflows/ci.yml:1`	Missing top-level permissions block
LOW	`TAINT-GH-001`	`.github/workflows/ci.yml:42`	Possible taint flow
LOW	`ENGINE-ERR`	`.github/workflows/big.yml:0`	File size 60000 bytes exceeds scanner cap (50000)