# CI/CD security pre-scan report

Target: `sample-repo` — 1 workflow file(s) scanned.

Findings: **HIGH**: 4, **MEDIUM**: 2, **INFO**: 1

- **HIGH** `PRT-WRITE` — `.github/workflows/deploy.yml:1` — contents: write granted under pull_request_target — fork PRs can reach a write-capable token
- **HIGH** `SELFHOSTED-PR` — `.github/workflows/deploy.yml:7` — self-hosted runner executes pull-request-triggered jobs — fork code runs on your infrastructure with whatever persists there
- **HIGH** `PWN-REQUEST` — `.github/workflows/deploy.yml:11` — pull_request_target + checkout of the untrusted PR head: fork code executes with a write token and secrets — the classic pwn request
- **HIGH** `SCRIPT-INJECTION` — `.github/workflows/deploy.yml:15` — attacker-controlled ${{ }} context interpolated directly into a run: shell block — route it through an env: var and quote the expansion instead
- **MEDIUM** `ACTION-TAGPIN` — `.github/workflows/deploy.yml:11` — action pinned to a mutable ref, not a commit SHA: actions/checkout@v4
- **MEDIUM** `PIPE-EXEC` — `.github/workflows/deploy.yml:17` — remote content piped straight into a shell (curl|bash class) — verify the source and pin a version/hash
- **INFO** `PRT-BASE` — `.github/workflows/deploy.yml:1` — pull_request_target trigger: workflow runs in the base-repo context (write-capable token, secrets available) over fork-supplied events — every step below must treat PR data as hostile

---
*Pre-scan, not an audit: heuristic line-based checks; a clean report is not proof of pipeline safety.*