PipeShield Security Audit Report

CRITICAL PS-SEC-001 CWE-798

config.py:7

AWS Access Key ID exposed

Identified a standard AWS Access Key ID starting with 'AKIA' or 'ABIA'.

AWS_ACCESS_KEY_ID = "AKIA********MPLE"

Fix: Revoke the exposed key in the AWS IAM Console immediately and use IAM Roles or environment variables in secrets manager.

HIGH PS-SEC-008 CWE-798

config.py:9

Database connection string with embedded password

Identified a database URI containing hardcoded credentials (PostgreSQL, MySQL, MongoDB, Redis).

DATABASE_URL = "postgres://pg_admin:Supe********345!@db-prod.internal:5432/corp_data"

Fix: Inject database credentials via environment variables or secret stores (e.g., Vault, AWS Secrets Manager).

HIGH PS-SEC-004 CWE-798

config.py:11

Slack Webhook or Bot Token exposed

Identified a Slack Incoming Webhook URL or Bot OAuth Token (xoxb/xoxp).

SLACK_ALERT_WEBHOOK = "http********uvwx"

Fix: Revoke the Slack token or webhook URL from the Slack API App dashboard.

HIGH PS-DOCK-002 CWE-1104

Dockerfile:10

Unpinned base image tag (:latest or no tag)

Base image 'python:latest' uses mutable ':latest' tag.

FROM python:latest

Fix: Pin the base image to a specific immutable semantic version or SHA256 digest, e.g., `FROM python:3.12.3-slim-bookworm` or `FROM alpine@sha256:...`.

CRITICAL PS-DOCK-003 CWE-798

Dockerfile:12

Sensitive credential passed via ENV or ARG

A secret, token, key, or password is baked into an ENV or ARG instruction. These values persist in image layer metadata and are visible via `docker history`.

ENV API_SECRET_TOKEN=sk-live-99a8b7c6d5e4f3a2b1c0d9e8

Fix: Use BuildKit secret mounts (`RUN --mount=type=secret,id=mysecret ...`) or inject runtime environment variables instead of hardcoding in Dockerfile.

HIGH PS-DOCK-004 CWE-494

Dockerfile:17

Unverified download and shell execution (curl/wget | sh)

The RUN instruction pipes remote network content directly into a shell interpreter (`curl ... | sh` or `wget ... | bash`) without checksum verification.

curl -fsSL https://raw.githubusercontent.com/untrusted/installer.sh | sh

Fix: Download scripts to a temporary file, verify their cryptographic hash (e.g. `sha256sum -c`), and execute only after integrity verification.

MEDIUM PS-DOCK-005 CWE-668

Dockerfile:19

Use of ADD instead of COPY for local files

`ADD` has unexpected side effects: it extracts tar archives automatically and accepts remote URLs. Best practice is to use `COPY` for local files.

ADD src/ /app/src/

Fix: Replace `ADD` with `COPY` unless you explicitly require tar extraction capabilities.

HIGH PS-DOCK-001 CWE-250

Dockerfile:10

Container runs as root (missing non-root USER)

Container executes as default root user (UID 0).

Missing USER directive

Fix: Create a dedicated system user/group (e.g., `RUN addgroup -S appgroup && adduser -S appuser -G appgroup`) and switch to it using `USER appuser`.

LOW PS-DOCK-006 CWE-754

Dockerfile:1

Missing HEALTHCHECK instruction

No HEALTHCHECK instruction defined in Dockerfile.

Missing HEALTHCHECK

Fix: Add a `HEALTHCHECK --interval=30s --timeout=3s --retries=3 CMD curl -f http://localhost:8080/health || exit 1` instruction.

HIGH PS-JS-004 CWE-200

frontend_bundle.js:2

Leaked Internal Origin IP or Staging Hostname in Client-Side JS

Hardcoded RFC1918 private IP address (`10.x.x.x`, `192.168.x.x`, `172.16-31.x.x`) or internal hostname (`.internal`, `.corp`, `.local`, `.lan`) found in JavaScript code. This aids attackers in mapping internal infrastructure and bypassing CDN/WAF protection.

const INTERNAL_ORIGIN = "http://10.0.20.51:8080/status";

Fix: Replace hardcoded internal IPs and staging URLs with environment-specific runtime configuration variables.

HIGH PS-JS-001 CWE-200

frontend_bundle.js:3

Hidden Administrative, Debug, or Internal API Endpoint in JS Bundle

A JavaScript/TypeScript file references an administrative, internal, debug, or server-status route. Attackers extract these endpoints during client-side reconnaissance to discover unprotected admin functionality, IDOR vectors, or WAF bypass routes.

const ADMIN_EXPORT_ENDPOINT = "/api/v1/admin/users/export";

Fix: Remove internal/debug endpoint paths from public client-side bundles, enforce strict server-side RBAC/authentication on all administrative routes, and split admin bundles from public builds.

HIGH PS-JS-002 CWE-79

frontend_bundle.js:6

Unsafe DOM XSS Sink or Dynamic Code Execution (innerHTML / eval / document.write)

Detected dangerous client-side sink (`eval()`, `new Function()`, `document.write()`, `.innerHTML =`, or `dangerouslySetInnerHTML`). Unsanitized input reaching these sinks allows attackers to escalate HTML injection into full DOM-based Cross-Site Scripting (XSS).

document.getElementById("banner").innerHTML = untrustedHtml;

Fix: Use safe DOM APIs such as `textContent` or `innerText` instead of `innerHTML`, avoid `eval()` / `new Function()`, or sanitize untrusted HTML using DOMPurify before rendering.

MEDIUM PS-JS-005 CWE-345

frontend_bundle.js:7

Insecure Cross-Origin postMessage Wildcard ('*')

Using `postMessage(..., '*')` broadcasts sensitive client-side messages or tokens to any origin, allowing malicious iframes or windows to intercept data.

window.parent.postMessage({ status: "loaded" }, "*");

Fix: Always specify the exact target origin URL (e.g., `https://app.example.com`) as the second argument to `postMessage` and validate `event.origin` in message listeners.

MEDIUM PS-JS-003 CWE-540

frontend_bundle.js:10

Exposed Production SourceMap Reference (sourceMappingURL)

The JavaScript bundle contains a `sourceMappingURL` directive pointing to a `.map` file. In production, exposed source maps allow attackers to reconstruct the full unminified source code, developer comments, and business logic.

//# sourceMappingURL=frontend_bundle.js.map

Fix: Disable public source map generation in production builds (e.g., `productionSourceMap: false` in Webpack/Vite) or restrict `.map` file access at the reverse proxy/CDN layer.

CRITICAL PS-CICD-001 CWE-250

deploy.yml:14

Overly permissive workflow permissions (write-all)

The workflow or job explicitly grants `permissions: write-all`. This violates the principle of least privilege and allows compromised steps to write to all repo resources.

permissions: write-all

Fix: Grant only the minimal required permissions, e.g., `permissions: { contents: read, pull-requests: write }`.

HIGH PS-CICD-002 CWE-829

deploy.yml:21

Unpinned GitHub Action (mutable tag/branch used instead of full commit SHA)

Action 'actions/checkout' is pinned to mutable ref '@v3' instead of an immutable 40-char commit SHA.

uses: actions/checkout@v3

Fix: Pin third-party actions to a full 40-character commit SHA, e.g., `uses: actions/checkout@b4ffde5c8fafcde5c04619f5ecd0426728247c1b # v4.1.1`.

CRITICAL PS-CICD-003 CWE-78

deploy.yml:25

Potential script injection via untrusted GitHub context in 'run'

Untrusted context '${{ github.event.pull_request.title }}' used directly in shell execution script.

echo "Building PR release for: ${{ github.event.pull_request.title }}"

Fix: Pass untrusted inputs via intermediate environment variables rather than direct inline string interpolation: `env: PR_TITLE: ${{ github.event.pull_request.title }}`.

LOW PS-CICD-005 CWE-400

deploy.yml:17

Missing job execution timeout

Job 'release' does not define 'timeout-minutes'. Runaway jobs could deplete CI minutes.

job 'release': missing timeout-minutes

Fix: Specify a reasonable timeout for each job, e.g., `timeout-minutes: 15`.