[A-07] GitHub mirror workflow puts a PAT in the remote URL #43

New issue

Open

opened 2026-10-11 20:15:35 -05:00 by pyaniz · 0 comments

pyaniz commented

2026-10-11 20:15:35 -05:00

Owner

Audit ID: A-07 · Priority: P2 · Effort: S

GitHub mirror workflow puts a PAT in the remote URL (github-mirror.yml). It can leak into logs or the runner's git config. Use a credential helper or http.extraheader. It also mirrors staging, so work-in-progress code goes to GitHub.

Source: AUDIT_FINDINGS.md (audit 2026-10-11). Items marked (verify) need confirming first.

**Audit ID:** A-07 · **Priority:** P2 · **Effort:** S **GitHub mirror workflow puts a PAT in the remote URL** (`github-mirror.yml`). It can leak into logs or the runner's git config. Use a credential helper or `http.extraheader`. It also mirrors `staging`, so work-in-progress code goes to GitHub. Source: `AUDIT_FINDINGS.md` (audit 2026-10-11). Items marked *(verify)* need confirming first.

pyaniz added the

audit

security

labels

2026-10-11 20:15:35 -05:00