35 lines
1.3 KiB
Markdown
35 lines
1.3 KiB
Markdown
# vermine2047 Audit Findings
|
|
|
|
Security audit of `vermine2047` at commit `b1d73e6b08bf`. Each finding links to a detailed write-up (`NNN-*.md`) and a proposed patch (`NNN-*.patch`).
|
|
|
|
## Summary
|
|
|
|
**Total findings: 0**
|
|
|
|
## Findings
|
|
|
|
## Dropped in adjudication
|
|
|
|
These findings reproduced in Phase 4 but the Phase 4.5 gate judged them false positives or out of a realistic threat model.
|
|
|
|
- **Unpinned mutable CI action enabling supply chain hijacking** (high, .gitea/workflows/release.yaml): Malformed URL in `uses` breaks workflow parsing; step is unreachable and prevents execution entirely.; Relies on improbable upstream compromise; standard configuration gap rather than immediate vulnerability.
|
|
|
|
## Run details
|
|
|
|
- run id: `aa4595a1`
|
|
- commit: `b1d73e6b08bf7ed0157a03137cc3bb50c8d3a26c`
|
|
- branch: `main`
|
|
- scope: 214 file(s)
|
|
- files triaged: 214
|
|
- files escalated: 14
|
|
- files deep-reviewed: 14
|
|
- findings proposed: 1
|
|
- findings verified: 0
|
|
- findings discarded: 0
|
|
- findings dropped in adjudication: 1
|
|
- artifacts: 0 written, 0 failed, 0 pending
|
|
|
|
## How to read this directory
|
|
|
|
Each finding has a paired `NNN-<slug>.md` (the human report) and `NNN-<slug>.patch` (the proposed fix as a unified diff). The report carries the narrative; the patch is the suggested change. Regenerate a single finding's artifacts with `/audit --regen --finding N`.
|