Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
pear-devs/pear-desktop
master @ f3d41fb
2
Fixes
0
CVEs
HIGH
Peak severity
Highlights
Credential Exposure: 1 prior fix. Scrutinize any change in this area.
GitHub: most-fixed (2 issues). Treat as high-risk during review.
1 high-severity fix in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Credential Exposure: The use of custom, high-privilege repository secrets (like GH_TOKEN) in pull request workflows risks exposing powerful credentials to external contributors or untrusted code execution. Transitioning to ephemeral tokens mitigates this high-severity vector.
Privilege Escalation: Default GITHUB_TOKEN permissions in GitHub Actions are often overly permissive (write access by default), enabling malicious actors who compromise a workflow or exploit a runner to escalate privileges within the repository.