GitHub Actions Pipeline Audit
devsecops · easy · +35 XP
Target
GET /api/lab/pipeline-audit-101/workflow (raw .github/workflows/ci.yml)
POST /api/lab/pipeline-audit-101/submit body {issues: [...]}
Goal: the workflow contains (a) a hardcoded secret, (b) the dangerous pull_request_target trigger, and (c) permissions: write-all. Submit issues as a list of these three kinds (any order). Recognised tokens: hardcoded_secret, pull_request_target, write_all_permissions.
// AI hint · first is free · then 1 credit or 5 XP
// attack console
/api/lab/pipeline-audit-101/
// reuse on the cli
// submit flag
// no solves yet