ci: security scanning, with the findings read and justified #2

Merged

marcos-mendez merged 1 commit from ci/security-scan into master

2026-10-07 15:20:27 -03:00

marcos-mendez commented

2026-10-07 14:54:18 -03:00

(Migrated from github.com)

Calls security-scan.yml of keel-linux/.github (gitleaks, bandit,
semgrep, shellcheck on hosted runners, no secrets) on pull requests,
pushes to master and by hand. Not a required check.

Baseline from a scan of master, none a risk in this vendored boto 2.
B317: SAX parsing of the AWS endpoint's own responses. B506: the
contrib YAMLMessage, which nothing uses (tklbam reaches AWS through
boto3). B602 and semgrep's shell=True: the manage framework and
ShellCommand run their caller's command, unused by tklbam. semgrep's
ssl.wrap_socket calls set CERT_REQUIRED and check the hostname; its
insecure-file-permissions flags mode 0600, which is owner-only.

bandit cannot parse 62 files, which are Python 2. gitleaks: an STS
session credential that expired in 2012 and the AWS documentation's
CloudFront example key, both upstream test fixtures, allowlisted by
path in .github/gitleaks.toml.

Calls security-scan.yml of keel-linux/.github (gitleaks, bandit, semgrep, shellcheck on hosted runners, no secrets) on pull requests, pushes to master and by hand. Not a required check. Baseline from a scan of master, none a risk in this vendored boto 2. B317: SAX parsing of the AWS endpoint's own responses. B506: the contrib YAMLMessage, which nothing uses (tklbam reaches AWS through boto3). B602 and semgrep's shell=True: the manage framework and ShellCommand run their caller's command, unused by tklbam. semgrep's ssl.wrap_socket calls set CERT_REQUIRED and check the hostname; its insecure-file-permissions flags mode 0600, which is owner-only. bandit cannot parse 62 files, which are Python 2. gitleaks: an STS session credential that expired in 2012 and the AWS documentation's CloudFront example key, both upstream test fixtures, allowlisted by path in .github/gitleaks.toml.