Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

jmock-developers/jmock-library

              master @ 3e378f3
            

Fixes

CVEs

MEDIUM

Peak severity

100.0%

Coverage

Highlights

Privilege Escalation: 3 prior fixes. Scrutinize any change in this area.

.github/workflows/build.yml: most-fixed (1 issue). Treat as high-risk during review.

0 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Privilege Escalation: Overly permissive default GITHUB_TOKEN scopes in the snapshot workflow could allow an attacker who compromises a dependency or runner to perform unauthorized modifications. Restricting token permissions to read-only mitigates this risk.

Privilege Escalation: The release workflow lacked explicit token constraints, requiring a transition to a declared permissions block restricting write access strictly to contents and pull-requests.

Privilege Escalation: The main build workflow defaulted to elevated GITHUB_TOKEN permissions, necessitating a remediation to constrain permissions to contents read-only.