<< Back to security report
Repositorydadbodgeoff/drift →
Commite371dbf →
VerdictFAIL
Score0
DateSep 22, 2026
| Severity | Rule | Message | File:Line |
|---|---|---|---|
| HIGH | yaml.github-actions.security.run-shell-injection.run-shell-injection | Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR". | dadbodgeoff/drift/sse-resilience-0600d5c8/.github/workflows/drift-check-self.yml:107 → |
| HIGH | yaml.github-actions.security.run-shell-injection.run-shell-injection | Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR". | dadbodgeoff/drift/sse-resilience-0600d5c8/.github/workflows/engine-binary-release.yml:46 → |
| HIGH | python.lang.security.audit.subprocess-shell-true.subprocess-shell-true | Found 'subprocess' function 'run' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use 'shell=False' instead. | dadbodgeoff/drift/sse-resilience-0600d5c8/docs/beta-live-validation/harness/bisect-metric:50 → |
| HIGH | python.lang.security.audit.dangerous-subprocess-use-tainted-env-args.dangerous-subprocess-use-tainted-env-args | Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. | dadbodgeoff/drift/sse-resilience-0600d5c8/docs/beta-live-validation/harness/corpus:21 → |
| HIGH | python.lang.security.audit.dangerous-subprocess-use-tainted-env-args.dangerous-subprocess-use-tainted-env-args | Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. | dadbodgeoff/drift/sse-resilience-0600d5c8/docs/beta-live-validation/harness/corpus:24 → |
| HIGH | python.lang.security.audit.subprocess-shell-true.subprocess-shell-true | Found 'subprocess' function 'run' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use 'shell=False' instead. | dadbodgeoff/drift/sse-resilience-0600d5c8/docs/beta-live-validation/harness/mutate:76 → |
| HIGH | python.lang.security.audit.dangerous-subprocess-use-tainted-env-args.dangerous-subprocess-use-tainted-env-args | Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. | dadbodgeoff/drift/sse-resilience-0600d5c8/docs/beta-live-validation/harness/selftest:377 → |
| HIGH | python.lang.security.audit.dangerous-subprocess-use-tainted-env-args.dangerous-subprocess-use-tainted-env-args | Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. | dadbodgeoff/drift/sse-resilience-0600d5c8/docs/beta-live-validation/harness/validate-result:33 → |