🚨 Runner-Guard Security Finding
Rule: RGS-012 — Secret Exfiltration via Outbound HTTP Request
Severity: High
File: .github/workflows/docs-noob-tester.lock.yml
Line: 575
Description
A run: block contains an outbound HTTP request command (curl, wget, httpie, python requests, node fetch, etc.) targeting a non-GitHub domain (i.e., not github.com, api.github.com, or ghcr.io) in a job context that has access to secrets or publishing capabilities. This pattern is a strong indicator of credential exfiltration.
Impact
The flagged step ("Wait for server readiness", line 576) runs curl -sf (localhost/redacted) in a polling loop to detect when the local docs preview server (started by the prior step on --host 0.0.0.0 --port 4321) is ready. The destination is localhost, not an external attacker-controlled domain, so this specific instance looks like a **likely false positive** — runner-guard's non-GitHub-domain heuristic does not special-case loopback addresses. That said, the preview server is bound to 0.0.0.0(all interfaces) rather than127.0.0.1`, which is unnecessary here and worth tightening.
Remediation
- Verify the
curl target is genuinely localhost/127.0.0.1 only (confirmed at line 576 in the current lock file) and, if so, this can be marked as a false positive for this rule/file combination.
- Bind the dev server to
127.0.0.1 instead of 0.0.0.0 in the "Start docs server" step so the port is not reachable from outside the runner, removing any ambiguity.
- If future changes to this workflow add real outbound requests to third-party domains, re-run static analysis and review those specifically for secret exposure.
Detected by runner-guard v2.6.0 — CI/CD source-to-sink vulnerability scanner
Workflow run: https://github.com/github/gh-aw/actions/runs/30881086944
Generated by 📊 Static Analysis Report · agent · 216.2 AIC · ⌖ 39.2 AIC · ⊞ 5.7K · ◷
🚨 Runner-Guard Security Finding
Rule: RGS-012 — Secret Exfiltration via Outbound HTTP Request
Severity: High
File:
.github/workflows/docs-noob-tester.lock.ymlLine: 575
Description
A
run:block contains an outbound HTTP request command (curl, wget, httpie, python requests, node fetch, etc.) targeting a non-GitHub domain (i.e., not github.com, api.github.com, or ghcr.io) in a job context that has access to secrets or publishing capabilities. This pattern is a strong indicator of credential exfiltration.Impact
The flagged step ("Wait for server readiness", line 576) runs
curl -sf (localhost/redacted) in a polling loop to detect when the local docs preview server (started by the prior step on--host 0.0.0.0 --port 4321) is ready. The destination islocalhost, not an external attacker-controlled domain, so this specific instance looks like a **likely false positive** — runner-guard's non-GitHub-domain heuristic does not special-case loopback addresses. That said, the preview server is bound to0.0.0.0(all interfaces) rather than127.0.0.1`, which is unnecessary here and worth tightening.Remediation
curltarget is genuinelylocalhost/127.0.0.1only (confirmed at line 576 in the current lock file) and, if so, this can be marked as a false positive for this rule/file combination.127.0.0.1instead of0.0.0.0in the "Start docs server" step so the port is not reachable from outside the runner, removing any ambiguity.Detected by runner-guard v2.6.0 — CI/CD source-to-sink vulnerability scanner
Workflow run: https://github.com/github/gh-aw/actions/runs/30881086944