Daily VulnHunter Scan

Durable reports produced by .github/workflows/daily-vulnhunter-scan.md in github/gh-aw.

standalone

.github/workflows/daily-vulnhunter-scan.md

View authored workflow

Reports

0 Open 3 Resolved

Daily VulnHunter Scan completed with no action

Daily VulnHunter Scan VulnHunter scan of github/gh-aw complete — no exploitable vulnerabilities confirmed. Scope: the 40 pre-ranked files in scope/candidates.txt (Go CLI/compiler/parser packages plus the actions/setup .cjs runtime scripts). Applied phase2classinj.md (injection classes) and falsified every candidate with phase2bverify.md. Notes written to /tmp/gh-aw/agent/vulnhunter/out/phase2boutput.md. Result: 17 injection-class candidates raised, 0 survived falsification. Representative eliminations (each cites the specific defense): git argument injection in the API-auth fallback paths (git archive / clone / checkout / ls-remote) — gated by gitutil.ValidateGitRef and ValidateGitPath be...

complete live noop

Daily VulnHunter Scan completed with no action

Daily VulnHunter Scan VulnHunter scan of github/gh-aw complete — no exploitable vulnerabilities confirmed. Scanned 38 of the 40 pre-ranked candidate files (2 absent from the snapshot, see gaps below). Phase 2 (injection class) surfaced 11 candidates; all 11 were eliminated in Phase 2b adversarial verification with cited file:line evidence. Representative eliminations: validatesecrets.cjs:156 (GraphQL interpolation of owner/repo) — values come from context.repo/GITHUBREPOSITORY; GitHub's owner/repo charset [A-Za-z0-9.-] excludes quotes and backslashes, so the string literal cannot be escaped. Gate 2a fail. artifactclient.cjs:418 (Content-Disposition -> path.join) — parseFilenameFromContent...

complete live noop

[aw] Daily VulnHunter Scan failed

Workflow Failure Workflow: Daily VulnHunter Scan Branch: main Run: https://github.com/github/gh-aw/actions/runs/32814355410 [!WARNING] Engine Max Runs Exceeded: The claude engine hit the workflow max runs guardrail and could not continue. This signal was detected from engine runtime logs. What to do next Increase workflow max-runs if the task legitimately needs more model invocations. Reduce per-run model calls by simplifying prompts, limiting retries, or breaking work into smaller steps. Review the run logs to identify repeated loops or retries that consumed invocation budget unexpectedly. Action Required Assign this issue to an agent to debug and fix the issue. <details> <summary>Debug ...

closed live issue