Mark/animsuite

Fork 0

[Security] HIGH: 9 issue(s) found in animsuite #24

New issue

Closed

opened 2026-05-14 23:21:51 +00:00 by Mark · 2 comments

Mark commented

2026-05-14 23:21:51 +00:00

Owner

Security Scan Results for `animsuite`

Severity: HIGH
Findings: 9

1. secret_in_diff

Details: Potential AWS Secret Key found in commit 491ea179
Commit: 491ea179
Pattern: AWS Secret Key

2. secret_in_diff

Details: Potential AWS Secret Key found in commit ff0da7b2
Commit: ff0da7b2
Pattern: AWS Secret Key

3. secret_in_diff

Details: Potential AWS Secret Key found in commit 3011ff66
Commit: 3011ff66
Pattern: AWS Secret Key

4. secret_in_diff

Details: Potential AWS Secret Key found in commit 623d32d9
Commit: 623d32d9
Pattern: AWS Secret Key

5. secret_in_diff

Details: Potential AWS Secret Key found in commit 6f074eec
Commit: 6f074eec
Pattern: AWS Secret Key

6. secret_in_diff

Details: Potential AWS Secret Key found in commit 1448e0ff
Commit: 1448e0ff
Pattern: AWS Secret Key

7. secret_in_diff

Details: Potential AWS Secret Key found in commit 1cdb4cf8
Commit: 1cdb4cf8
Pattern: AWS Secret Key

8. secret_in_diff

Details: Potential AWS Secret Key found in commit b1f52274
Commit: b1f52274
Pattern: AWS Secret Key

9. vulnerable_dependency

Details: Potentially vulnerable dependency: pillow — CVE-2023-4863. Check version and upgrade if needed.

This issue was auto-generated by the security sweep cron job.

## Security Scan Results for `animsuite` **Severity:** HIGH **Findings:** 9 ### 1. secret_in_diff - **Details:** Potential AWS Secret Key found in commit 491ea179 - **Commit:** `491ea179` - **Pattern:** `AWS Secret Key` ### 2. secret_in_diff - **Details:** Potential AWS Secret Key found in commit ff0da7b2 - **Commit:** `ff0da7b2` - **Pattern:** `AWS Secret Key` ### 3. secret_in_diff - **Details:** Potential AWS Secret Key found in commit 3011ff66 - **Commit:** `3011ff66` - **Pattern:** `AWS Secret Key` ### 4. secret_in_diff - **Details:** Potential AWS Secret Key found in commit 623d32d9 - **Commit:** `623d32d9` - **Pattern:** `AWS Secret Key` ### 5. secret_in_diff - **Details:** Potential AWS Secret Key found in commit 6f074eec - **Commit:** `6f074eec` - **Pattern:** `AWS Secret Key` ### 6. secret_in_diff - **Details:** Potential AWS Secret Key found in commit 1448e0ff - **Commit:** `1448e0ff` - **Pattern:** `AWS Secret Key` ### 7. secret_in_diff - **Details:** Potential AWS Secret Key found in commit 1cdb4cf8 - **Commit:** `1cdb4cf8` - **Pattern:** `AWS Secret Key` ### 8. secret_in_diff - **Details:** Potential AWS Secret Key found in commit b1f52274 - **Commit:** `b1f52274` - **Pattern:** `AWS Secret Key` ### 9. vulnerable_dependency - **Details:** Potentially vulnerable dependency: pillow — CVE-2023-4863. Check version and upgrade if needed. --- *This issue was auto-generated by the security sweep cron job.*

Mark added the

triage-approved

bug

labels

2026-05-17 22:57:54 +00:00

Mark added

blocked:needs-decision

and removed

triage-approved

bug

labels

2026-05-19 03:03:51 +00:00

Mark commented

2026-05-19 03:17:05 +00:00

Author

Owner

Feature Triage Assessment

Scope: small
Risk: low
Spec Alignment: misaligned
Summary: All 9 findings are security scanner false positives: 8 SHA hashes in .gsd/gate-state.json are misidentified as AWS Secret Keys, and pillow (v12.1.0 installed) is flagged for CVE-2023-4863 which affects <10.0.1 — the unpinned requirements.txt entry alone triggers the scanner.
Recommendation: Close as false positive with rationale. Optionally: (a) pin pillow version in requirements.txt/pyproject.toml to suppress the CVE alert, and (b) add .gsd/*.json to the scanner's exclude list so commit SHAs stop triggering AWS key pattern matches. No code changes needed.
Rationale: Scope: trivial — no code changes needed, just config changes if any. Risk: low — no actual credentials leaked (the 'secrets' are git commit SHAs in GSD gate-state JSON files); pillow is at 12.1.0, far above the CVE-2023-4863 threshold. Spec: misaligned — there is no real vulnerability to address.

Labeled blocked:needs-decision — unblock on Forgejo to dispatch to the fixer pipeline.

## Feature Triage Assessment **Scope:** small **Risk:** low **Spec Alignment:** misaligned **Summary:** All 9 findings are security scanner false positives: 8 SHA hashes in .gsd/gate-state.json are misidentified as AWS Secret Keys, and pillow (v12.1.0 installed) is flagged for CVE-2023-4863 which affects <10.0.1 — the unpinned requirements.txt entry alone triggers the scanner. **Recommendation:** Close as false positive with rationale. Optionally: (a) pin pillow version in requirements.txt/pyproject.toml to suppress the CVE alert, and (b) add .gsd/*.json to the scanner's exclude list so commit SHAs stop triggering AWS key pattern matches. No code changes needed. **Rationale:** Scope: trivial — no code changes needed, just config changes if any. Risk: low — no actual credentials leaked (the 'secrets' are git commit SHAs in GSD gate-state JSON files); pillow is at 12.1.0, far above the CVE-2023-4863 threshold. Spec: misaligned — there is no real vulnerability to address. Labeled `blocked:needs-decision` — unblock on Forgejo to dispatch to the fixer pipeline.

Mark commented

2026-05-23 18:33:48 +00:00

Author

Owner

No longer reproducible — gitleaks scan shows 0 findings in current tree and git history. These were likely in old commits that have since been cleaned up or were false positives resolved by code changes.

Closing as resolved.

Mark closed this issue

2026-05-23 18:33:49 +00:00