Search results

[BUG] Fix false positive on "workflow inlines user input into a shell script"

bugSomething isn't workingSomething isn't working

Status: Open.

#229 In getplumber/plumber;

· thomasboni opened on Jun 4, 2026

[BUG] Different analysis score locally and in GitHub Actions

bugSomething isn't workingSomething isn't working

Status: Open.

#228 In getplumber/plumber;

· outscale-rce opened on Jun 4, 2026

[BUG] A non-existent project or branch silently returns 100% compliance instead of failing

bugSomething isn't workingSomething isn't working

Status: Open.

#222 In getplumber/plumber;

· thomasboni opened on Jun 3, 2026

[BUG] Fix display on data collection fail

bugSomething isn't workingSomething isn't working

Status: Open.

#220 In getplumber/plumber;

· thomasboni opened on May 29, 2026

[FEAT] --score option should be default

enhancementNew feature or requestNew feature or request

Status: Open.

#218 In getplumber/plumber;

· thomasboni opened on May 29, 2026

Token-Permissions Error (compliance.yml)

Status: Open.

#217 In getplumber/plumber;

· duggytuxy opened on May 29, 2026

[FEAT] per-file allowlist for workflowMustNotUseDangerousTriggers

enhancementNew feature or requestNew feature or request

Status: Open.

#204 In getplumber/plumber;

· goabonga opened on May 26, 2026

[DOCS] Simplify README

documentationImprovements or additions to documentationImprovements or additions to documentation

enhancementNew feature or requestNew feature or request

Status: Open.

#200 In getplumber/plumber;

· thomasboni opened on May 25, 2026

LOTP: recognise bare git clone and third-party checkout actions

Status: Open.

#199 In getplumber/plumber;

· stephrobert opened on May 23, 2026

LOTP: match multi-word commands (go generate)

Status: Open.

#198 In getplumber/plumber;

· stephrobert opened on May 23, 2026

LOTP: detect env-var poisoning vector (BASH_ENV, TAR_OPTIONS, npm_config_*)

Status: Open.

#197 In getplumber/plumber;

· stephrobert opened on May 23, 2026

[FEAT] Detect RCE-by-design dev tools running on untrusted code (LOTP catalog)

Status: Open.

#189 In getplumber/plumber;

· stephrobert opened on May 22, 2026