Open Issues Need Help
View All on GitHub [sec-check] ai-fix.yml and copilot-automation.yml lack fork guard on pull_request_target (write-capable) about 2 hours ago
help wanted security
[sec-check] ci: docs/ai-fix.yml and copilot-automation.yml use pull_request_target with write permissions and no fork guard about 3 hours ago
help wanted security
[sec-check] ci: transitive mutable-tag third-party actions inside SHA-pinned kubestellar/infra reusable workflows about 4 hours ago
help wanted security
[sec-check] ci: copilot-dco.yml.disabled retains unsafe defaults — no permissions block, uses @main ref about 4 hours ago
help wanted security
[ci-maintainer] PR Verifier rejects scanner-generated PRs — [scanner] prefix fails Conventional Commits check about 4 hours ago
help wanted ci
[sec-check] docs: pr-verifier.yml uses third-party action not pinned by hash (Scorecard alert #224) about 4 hours ago
help wanted security
[sec-check] docs: new write-scoped automation workflows expose broad token permissions about 8 hours ago
help wanted security
[sec-check] docs: no fuzzing tool configured — MDX sanitizer and search API routes not fuzz-tested about 8 hours ago
help wanted security
[sec-check] docs: 4 new workflows with job-level write token permissions flagged by Scorecard about 8 hours ago
help wanted security
[ci-maintainer] Fuzz MDX Sanitizer CI check failing on scanner/fix-6215 (fuzz harness exits non-zero) about 9 hours ago
help wanted ci
[sec-check] docs: no SAST tool configured — Next.js API routes not analyzed for injection vulnerabilities about 22 hours ago
help wanted security
[sec-check] docs: no mandatory code review — PRs can be merged without human approval about 22 hours ago
help wanted security
[sec-check] docs: default branch lacks branch protection — force-push and bypass possible about 22 hours ago
help wanted security
[sec-check] docs: scorecard.yml passes secrets:inherit to mutable @main reusable workflow with id-token:write about 23 hours ago
help wanted security
[sec-check] docs: 5 additional workflows call mutable reusable workflows @main (pull_request_target + schedule) about 23 hours ago
help wanted security
[sec-check] pull_request_target workflows (greetings.yml, pr-verifier.yml) call mutable reusable workflows @main about 24 hours ago
help wanted security
[sec-check] pull_request_target ai-fix.yml calls mutable reusable workflow @main — pwn-request risk about 24 hours ago
help wanted security
[sec-check] docs: copilot-dco.yml has no permissions block — token inherits repo-wide defaults 1 day ago
help wanted security
help wanted security
[ci-maintainer] PR Verifier workflow startup failure on all PRs — missing reusable workflow 1 day ago
help wanted ci
help wanted ci
help wanted kind/documentation
help wanted ci
help wanted security
help wanted security
[ci-maintainer] Greetings workflow startup_failure on all runs — broken reusable workflow reference 6 days ago
help wanted ci
[sec-check] TokenPermissions: pr-verifier.yml lacks top-level read-all permissions (Scorecard HIGH) 6 days ago
help wanted security
[sec-check] OpenSSF CII Best Practices badge absent — Scorecard CIIBestPracticesID alert in 5 repos 7 days ago
help wanted security
help wanted security
help wanted security
help wanted ci
help wanted security
[sec-check] disabled workflow files retain pre-fix pwn-request patterns — delete or update 9 days ago
help wanted security
help wanted security
help wanted security
help wanted security
help wanted security
[sec-check] pr-verifier.yml calls non-existent reusable-pr-verifier.yml — PR title check disabled 9 days ago
help wanted security
help wanted security
bug documentation good first issue help wanted
bug documentation good first issue help wanted
bug documentation good first issue help wanted
bug documentation good first issue help wanted
help wanted security
help wanted security
help wanted security
bug documentation good first issue help wanted
bug documentation good first issue help wanted
bug documentation good first issue help wanted
bug documentation good first issue help wanted
[sec-check] Token-Permissions: 11 Scorecard alerts for over-permissive GITHUB_TOKEN in workflows 13 days ago
help wanted security
help wanted quality testing
[sec-check] Token-Permissions: 7 additional Scorecard alerts in 5 workflows not covered by #6099 13 days ago
help wanted security
[sec-check] Code-Review score 0 — 0/26 recent changesets had an approved review (Scorecard high) 13 days ago
help wanted security
[sec-check] Token-Permissions: 9 workflow files with job-level write scopes (Scorecard high) 13 days ago
help wanted security
[sec-check] Scorecard VulnerabilitiesID: open/unfixed known vulnerabilities in dependency tree (high) 13 days ago
help wanted security
help wanted security
[quality] src/config/versions.ts has 11 routing-critical functions with zero test coverage 14 days ago
help wanted quality testing
[sec-check] Rollout-checker CronJobs mount OCI config at /root/.oci — containers likely running as root 14 days ago
help wanted security
help wanted security
help wanted security
help wanted security
bug documentation good first issue help wanted
bug documentation good first issue help wanted
bug documentation good first issue help wanted
bug documentation good first issue help wanted
[sec-check] Token-Permissions regression — 5 new workflows missing job-level permission scoping 15 days ago
help wanted security
[sec-check] Missing permissions block in copilot-dco.yml (not propagated from console fix) 15 days ago
help wanted security
bug documentation good first issue help wanted
bug documentation good first issue help wanted
bug documentation good first issue help wanted
bug documentation good first issue help wanted
[sec-check] pr-verifier.yml: pull_request_target + secrets: inherit exposes all repo secrets 16 days ago
help wanted security
help wanted security
[sec-check] greetings.yml: pull_request_target + secrets: inherit exposes all repo secrets 16 days ago
help wanted security
bug documentation good first issue help wanted
bug documentation good first issue help wanted
bug documentation good first issue help wanted
bug documentation good first issue help wanted
bug documentation good first issue help wanted
bug documentation good first issue help wanted
bug documentation good first issue help wanted
bug documentation good first issue help wanted
bug documentation good first issue help wanted
bug documentation good first issue help wanted
bug documentation good first issue help wanted
bug documentation good first issue help wanted
bug documentation good first issue help wanted
bug documentation good first issue help wanted
bug documentation good first issue help wanted
bug documentation good first issue help wanted
bug documentation good first issue help wanted
bug documentation good first issue help wanted
bug documentation good first issue help wanted
bug documentation good first issue help wanted
bug documentation good first issue help wanted
bug documentation good first issue help wanted
bug documentation good first issue help wanted
bug documentation good first issue help wanted
bug documentation good first issue help wanted