ci: remove the vu1nz security scan - #232
Merged
Merged
Conversation
vu1nz reviews a diff by calling Claude, which needs ANTHROPIC_API_KEY supplied through the ENV_FILE secret. That key is not present on this repository, so the scanner has never reviewed a pull request. On pack 1.0.0 and 1.0.1 that failure was silent: the job reported "0 finding(s), no high/critical issues" on a diff nothing had read, which is worse than no scanner at all. threatcrush-scan covers the same ground deterministically - credentials, injection, SSRF, unsafe deserialisation, XXE, dependency tampering - with no API key and no per-pull-request cost. Reinstallable from the sh1pt Actions Store if the key is ever provisioned. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Removes
.github/workflows/vu1nz-scan.yml.It has never worked here. vu1nz reviews a diff by calling Claude, which needs
ANTHROPIC_API_KEYsupplied through theENV_FILEsecret. That key is not present on this repository — so every run either skipped the review step or, on pack1.0.0/1.0.1, reported "0 finding(s), no high/critical issues" on a diff nothing had read. A green check for an unreviewed change is worse than no check.threatcrush-scancovers the same ground deterministically — hardcoded credentials, injection, SSRF, unsafe deserialisation, XXE and dependency tampering — with no API key and no per-PR cost. It scores 90.32% true-positive rate at 0.0% false-positive rate againstprofullstack/malware-test-prs.Reinstallable from the sh1pt Actions Store in one command if
ANTHROPIC_API_KEYis ever provisioned.🤖 Generated with Claude Code