Runner-Guard Security Finding
Rule: RGS-012 — Secret Exfiltration via Outbound HTTP Request
Severity: High
File: Multiple workflows
Occurrences: 3 findings in 2 workflows
Description
run: blocks contain outbound HTTP request commands (curl, wget, etc.) targeting non-GitHub domains in job contexts that have access to secrets or publishing capabilities. This pattern is a strong indicator of credential exfiltration — the primary objective of most GitHub Actions supply-chain attacks.
Impact
Attackers who achieve code execution in a CI runner (via expression injection, fork checkout, compromised action, etc.) can exfiltrate stolen secrets to attacker-controlled infrastructure via HTTP POST requests. The combination of external HTTP requests with secrets access in a workflow triggered by untrusted events is a high-confidence indicator of either active exploitation or a pattern that could be exploited.
Affected Workflows
docs-noob-tester — Line 444visual-regression-checker — Lines 392, 733
Remediation
-
Audit all external HTTP calls in affected workflows — determine if the destination domain is trusted and necessary.
-
Restrict outbound HTTP calls to known-good domains via network policy or firewall rules.
-
Avoid secrets in outbound-HTTP job contexts — separate jobs that need external HTTP calls from jobs that use secrets.
-
Review visual regression check tool — ensure the tool sending HTTP requests to external services is not inadvertently transmitting secrets.
-
Use GitHub's native artifact upload instead of external HTTP endpoints for sharing data between jobs.
# Instead of posting results to an external service with a token:
run: curl -X POST (externalservice.com/redacted) -H "Authorization: ${{ secrets.TOKEN }}" ...
# Use GitHub Actions artifacts for sharing data:
- uses: actions/upload-artifact@<sha>
with:
name: report
path: report.json
Detected by runner-guard v2.6.0 — CI/CD source-to-sink vulnerability scanner
Workflow run: https://github.com/github/gh-aw/actions/runs/25206730082
Generated by Static Analysis Report · ● 332.6K · ◷
Runner-Guard Security Finding
Rule: RGS-012 — Secret Exfiltration via Outbound HTTP Request
Severity: High
File: Multiple workflows
Occurrences: 3 findings in 2 workflows
Description
run:blocks contain outbound HTTP request commands (curl,wget, etc.) targeting non-GitHub domains in job contexts that have access to secrets or publishing capabilities. This pattern is a strong indicator of credential exfiltration — the primary objective of most GitHub Actions supply-chain attacks.Impact
Attackers who achieve code execution in a CI runner (via expression injection, fork checkout, compromised action, etc.) can exfiltrate stolen secrets to attacker-controlled infrastructure via HTTP POST requests. The combination of external HTTP requests with secrets access in a workflow triggered by untrusted events is a high-confidence indicator of either active exploitation or a pattern that could be exploited.
Affected Workflows
docs-noob-tester— Line 444visual-regression-checker— Lines 392, 733Remediation
Audit all external HTTP calls in affected workflows — determine if the destination domain is trusted and necessary.
Restrict outbound HTTP calls to known-good domains via network policy or firewall rules.
Avoid secrets in outbound-HTTP job contexts — separate jobs that need external HTTP calls from jobs that use secrets.
Review visual regression check tool — ensure the tool sending HTTP requests to external services is not inadvertently transmitting secrets.
Use GitHub's native artifact upload instead of external HTTP endpoints for sharing data between jobs.
Detected by runner-guard v2.6.0 — CI/CD source-to-sink vulnerability scanner
Workflow run: https://github.com/github/gh-aw/actions/runs/25206730082