Scan results · 91c7b3d
PR #693 · shiva/remove-self-scan-workflow → main · 2 critical · 14 high · 59 medium · 82 low
- medium Missing pipefail in Shell Commands sast-engine/Dockerfile:13
RUN instruction uses pipes without 'set -o pipefail'. This masks failures in piped commands.
- medium Sudo Usage in Dockerfile sast-engine/Dockerfile:16
Dockerfile uses 'sudo' in RUN instructions. This is unnecessary during build (already root) and increases security risk if sudo remains in the final image. Use USER instruction for privilege changes instead.
- medium Privileged Port Exposed sast-engine/Dockerfile:21
Exposing port below 1024 typically requires root privileges to bind. Consider using non-privileged ports (>1024) with port mapping or granting CAP_NET_BIND_SERVICE capability.
- medium Multiple CMD Instructions sast-engine/Dockerfile:23
Multiple CMD instructions detected. Only the last one takes effect.
- medium Using Host IPC Mode sast-engine/docker-compose.yml:9
[Service: web] Service uses host IPC namespace. Container shares inter-process communication with host.
- medium SELinux Separation Disabled sast-engine/docker-compose.yml:14
[Service: web] Service has 'label:disable' in security_opt, which disables SELinux mandatory access control. This removes a critical security layer and increases the impact of container compromises. Remove label:disable or use custom SELinux labels instead.
- medium Missing no-new-privileges Security Option sast-engine/docker-compose.yml:20
[Service: app] Service does not have 'no-new-privileges:true' in security_opt. This allows processes to gain additional privileges via setuid/setgid binaries, which can be exploited for privilege escalation attacks.
- medium Non-literal import Detected sast-engine/tools/generate_stdlib_registry.py:567
__import__() or importlib.import_module() with non-literal argument detected.
- medium Logger Credential Leak Risk sast-engine/tools/typeshed-converter/convert.py:333
Logging call detected. Audit log statements for credential/secret leakage.
- medium Logger Credential Leak Risk sast-engine/tools/typeshed-converter/convert.py:444
Logging call detected. Audit log statements for credential/secret leakage.
Get this for your repo.
Pathfinder runs the same scan on your own repos free. Connect via GitHub in 30 seconds.