docs: first-screen treatment for both READMEs - #34
Merged
Conversation
…asses Injection vectors, supply chain risks, excessive permissions and secret exposure are categories. They tell a reader who already knows the field nothing new, and a reader who does not, nothing at all. Both READMEs now name three concrete mistakes and what each hands an attacker: an issue title interpolated into a run block, pull_request_target on untrusted code, an action pinned to a mutable tag. The exclusion paragraph is honest that a private repo with trusted contributors lacks the surface most of these findings need. Both language versions in one commit, per documentation.md section 5.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Was
Der Einstieg zählte Schwachstellenklassen auf. Neu stehen drei konkrete Fehler mit ihrer Folge: Issue-Titel im
run:-Block,pull_request_targetauf ungeprüftem Code, Action auf einen Tag gepinnt.Der Ausschlusssatz sagt ehrlich, dass ein privates Repo mit vertrauenswürdigen Beitragenden die nötige Angriffsfläche gar nicht hat.
Warum
standards/documentation.md, Abschnitt "The first screen".Nebenwirkungen
Keine, reine Doku. Version 0.3.6 mit CHANGELOG-Eintrag.