[uk ai resilience] UK AI Open Code & Vulnerability Risk Review — github/gh-aw (2026-08-04 to 2026-08-11)

[github-actions[bot]]

UK AI Open Code & Vulnerability Risk Review — github/gh-aw (7-day window)

Aligned to [UK Gov: AI, open code and vulnerability risk in the public sector]((www.gov.uk/redacted) Focus: recent-change prioritisation, resilience over concealment.

Window: 2026-08-04 → 2026-08-11 · 445 commits (164 security-signal) · 21 open security issues · 5 open code-scanning alerts · 0 open secret-scanning alerts.

⚠️ Process note: The asset-tier-classifier, control-verifier, and ai-risk-scorer sub-agents each failed to return output after one retry. This report was produced with reduced confidence via direct evidence review (repo files, issue bodies, alert instances) in their place. Findings below are still evidence-cited but should be treated as a single-reviewer pass rather than a triple sub-agent consensus.

1. Executive Summary

No critical, actively-exploitable findings were identified this window. The two CodeQL Go/JS alerts investigated resolve to already-mitigated or false-positive states on inspection of current source. The two "Secret Exfiltration" static-analysis issues on compiled workflow lock files are self-flagged false positives (verified installer + checksum, localhost-only traffic) already annotated as such by the detecting agent. The dominant real, open risk surface is a backlog of 7 container-image CVE findings across firewall/mcpg/mcp-server base images, which is being actively worked via version-bump chores. Secret-masking and sanitizer hardening saw the heaviest remediation velocity this week (10+ merged fixes), indicating strong operational resilience in that subsystem. No new issues are created this run — all identified risks are either already tracked by existing open issues or are false positives not warranting new tickets.

2. Asset Graph Summary (recent-change scoped)

Segment	Files/Areas	Notes
GraphQL project API client	pkg/cli/project_command.go	getOwnerNodeId uses parameterized GraphQL variables (map[string]any{"login": owner}), not string-interpolated Sprintf into the query — alert appears stale relative to current code.
Docs slide-deck build tool	scripts/ensure-docs-slide-pdf.js:197	Explicit code comment + lgtm[js/http-to-file-access] suppression documents that readPdfBytes() only returns bytes from a validated, hardcoded GitHub media URL with content-type/size/signature checks, or a local placeholder.
Compiled lock workflows	daily-byok-ollama-test.lock.yml, daily-model-inventory.lock.yml	Flagged commands are official Ollama installer (sha256-verified) + localhost polling — non-exfiltration pattern, already annotated as likely false positive in the issue body by the detector's own investigation note.
Container supply chain	node:lts-alpine, gh-aw-mcpg:v0.4.8, gh-aw-firewall/{api-proxy,squid,cli-proxy,agent}:0.27.44, github-mcp-server:v1.8.0	7 open container-image-scan issues (base-image CVEs). Active patch cadence evidenced by "Bump default gh-aw-firewall version" and "chore: bind gh-aw-detection to latest release" commit patterns.
Sanitizer / secret-masking	git auth helpers, step-summary writer, OTLP exporter, upload_artifact safe-output, URL authority parser	Highest remediation velocity this week: authHeader masking, OTLP token masking, git secret-leakage fix, artifact path restriction, URL parsing hardening — all merged, no open alerts.
Threat-detection subsystem	external detector pin, prompt-template/prompt-import-tree staging, strict-mode conclude path	Active iteration with several bug fixes (GITHUB_STEP_SUMMARY unwritable in AWF sandbox, strict-mode no-outputs failure) — no open alerts currently.
Dependency updates	dompurify (npm_and_yarn group)	Routine bot-driven patch bump, low risk.

Ownership signal: commit activity concentrated in pelikhan (maintainer) plus automated Copilot coding-agent and gh-aw-bot commits — consistent single-maintainer + AI-agent contribution pattern typical of this repo.

3. Tier Classification

Area	Tier	Rationale
GraphQL project client (project_command.go)	A — Open Safe	Uses GraphQL variables, not raw interpolation; alert likely stale.
ensure-docs-slide-pdf.js	A — Open Safe	Explicit validation (URL fixed, content-type/size/signature checked) and documented suppression.
daily-byok-ollama-test.lock.yml / daily-model-inventory.lock.yml	A — Open Safe	Verified-checksum installer + localhost traffic; detector's own note confirms benign pattern.
README.md workflow-security-finding-1 (#564)	A — Open Safe	Confirmed smoke-test dummy finding ("Smoke test dummy warning") from Smoke Claude test tool, not a real code path.
Container base images (7 CVE findings)	B — Open With Conditions	Real, tracked CVEs in supply-chain images; mitigated by active bump cadence but require confirmation each finding is scheduled for the next version bump.
Sanitizer/secret-masking subsystem	A — Open Safe	No open alerts; high, recent remediation velocity demonstrates strong operational resilience.
Threat-detection subsystem	B — Open With Conditions	Active development with recent stability bugs (non-security) fixed quickly; no open security alerts but bears monitoring given its security-adjacent role.

No Tier C or D areas identified this window.

4. Control Verification Gaps

(Direct review in lieu of failed control-verifier sub-agent; lower confidence, spot-checked rather than exhaustive.)

• Ownership: Single primary maintainer (pelikhan) drives most human-authored commits; heavy reliance on AI-agent (Copilot) commits for volume. No CODEOWNERS check performed this run — recommend confirming coverage for pkg/cli/, scripts/, and workflow lock generation paths.
• SDLC: CodeQL + actionlint gating confirmed active (source of the 5 alerts reviewed). Compiled .lock.yml files are generated artifacts — recommend confirming source .md workflow definitions, not just lock files, are the ones remediated when static-analysis flags recur.
• Dependency controls: Evidence of automated dependency bump commits (dompurify, container images) — good baseline; container CVEs (Tier B) suggest bump cadence lags behind upstream disclosure by more than a few days in some cases.
• Secret exposure controls: Strong — this week alone shipped masking for authHeader, OTLP tokens, and git invocation secrets, plus upload_artifact path restriction. Zero open secret-scanning alerts.
• Runtime observability: Threat-detection and step-summary sanitization commits indicate active runtime guardrails; not independently verified via telemetry dashboards this run.
• Recovery controls: Chore commits explicitly bump firewall/detection versions ("Bump default gh-aw-firewall version", "chore: bind gh-aw-detection to latest release"), showing rollback/patch readiness is operationalised via routine version-pin bumps.

5. Risk-Scoring Table and Rationale

(Direct estimation in lieu of failed ai-risk-scorer sub-agent.)

Area	Exposure Amplification	Patchability	Detectability	Operational Fragility	Ownership Confidence	Tier
Container base images (7 CVEs)	Medium	High (bump-and-redeploy pattern proven)	High (scanner already flags)	Low-Medium	Medium (bot + maintainer bumps)	B
Threat-detection subsystem	Low-Medium (no open alert)	High (frequent recent patches)	Medium (some recent bugs found only after deploy)	Medium (several fixes for sandbox/strict-mode issues this week)	Medium	B
Sanitizer/secret-masking	Low (actively hardened)	High	High	Low	High	A
GraphQL/PDF/lock-file findings	Low (false positive/stale)	N/A	High (already flagged & explained)	Low	High	A

6. Remediation Queue

Area	Action	SLA Urgency
Container images (7 open CVE findings: node:lts-alpine, gh-aw-mcpg, gh-aw-firewall×4, github-mcp-server)	Confirm each existing issue (#51710, #51707, #51329, #51328, #51022, #51021, #51020) has a scheduled version-bump PR; escalate any without an owner/target date.	Medium
workflow-go-graphql-injection-sprintf (#651/#652)	Dismiss as resolved/stale once confirmed current code uses parameterized variables (already appears to be the case) — avoids alert fatigue.	Low
RGS-012 findings (#51943/#51944)	Add scoped runner-guard suppression with justification comment per the issue's own remediation guidance, since investigation already confirms benign pattern.	Low
#564 dummy smoke finding	Close/dismiss as confirmed smoke-test artifact.	Low

No new GitHub issues were created this run — all real findings are already tracked by existing open issues, and the newly-investigated code-scanning alerts resolve to false positives/stale states best handled by dismissal rather than new tickets.

7. Exception Register

None required this window — no permanent hidden-repo or scope-reduction exceptions requested or recommended.

8. Operational Metrics Baseline

• MTTR proxy: Secret-masking fixes shipped same-window as related risk discovery (e.g., OTLP token masking, git secret leakage) — suggests low MTTR for secret-exposure classes.
• Ownership coverage: Concentrated in one human maintainer + AI-agent commits; CODEOWNERS coverage not verified this run (follow-up recommended).
• Unsupported dependency ratio: Not computed this run; container CVE backlog (7 open) is the primary visible proxy — recommend automated SBOM/dependency-age tracking for a future run.
• Exception aging: 0 active exceptions.
• Exposure without recovery capability: None identified — all flagged areas have either automated bump paths (containers) or rapid manual remediation (sanitizer subsystem) in place.

Generated by UK AI Operational Resilience · auto · 40.1 AIC · ⌖ 3.65 AIC · ⊞ 8.7K · ◷

• expires on Aug 14, 2026, 7:49 AM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by UK AI Operational Resilience.

A newer discussion is available at Discussion #52526.