VNX-GH-004 – Checkout credentials persisted into an uploaded workspace

Overview

By default actions/checkout stores the job’s GITHUB_TOKEN in .git/config so later git commands authenticate. Uploading the checkout directory as an artifact publishes that token to anyone who can download the run’s artifacts — on a public repository, everyone — while the job is still running.

Severity: High | Confidence: high | CWE: CWE-522, CWE-200 | Command: vulnetix gha workflows

Remediation

Set persist-credentials: false on actions/checkout, and upload only the build output directory, never the repository root.

Scoring

CWSS vector at the rule’s default severity: CWSS:1.0/TI:H/AP:A/AL:A/IC:N/FC:LT/RP:N/RL:A/AV:I/AS:N/IN:A/SC:A/BI:H/DI:M/EX:M/EC:N/P:W. A finding whose severity the repository’s settings moved is scored at its adjusted severity.