build(deps): bump github.com/sigstore/cosign/v2 from 2.2.3 to 2.2.4 #220
DryRunSecurity / Sensitive Files Analyzer
succeeded
May 29, 2024 in 1s
DryRun Security
Details
Sensitive Files Analyzer Findings: 3 detected
⚠️ Potential Sensitive File go.mod (click for details)
| Type | Potential Sensitive File |
| Description | Golang applications manage their dependencies through their go.mod and go.sum files. A change in these files may indicate an addition of a library/dependency which could introduce additional risk to the application either through vulnerable code, expansion of the application's attack surface via additional routes, or malicious code. |
| Filename | go.mod |
| CodeLink | Lines 10 to 16 in 52908a4 |
⚠️ Potential Sensitive File go.sum (click for details)
| Type | Potential Sensitive File |
| Description | Golang applications manage their dependencies through their go.mod and go.sum files. A change in these files may indicate an addition of a library/dependency which could introduce additional risk to the application either through vulnerable code, expansion of the application's attack surface via additional routes, or malicious code. |
| Filename | go.sum |
| CodeLink | Lines 10 to 17 in 52908a4 |
⚠️ Potential Sensitive File vendor/github.com/hashicorp/hcl/Makefile (click for details)
| Type | Potential Sensitive File |
| Description | Makefiles tend to influence the behavior of the executing program and can have security consequences if applied incorrectly. For example, having the ability to run commands that could be irreversible such as rm -rf /, changing file permissions, tampering with dependencies, and more. |
| Filename | vendor/github.com/hashicorp/hcl/Makefile |
| CodeLink | compage/vendor/github.com/hashicorp/hcl/Makefile Lines 1 to 18 in 52908a4 |
Loading