[uk ai resilience] UK AI Open Code Risk & Resilience Governance — Weekly Review (2026-07-24 to 2026-07-31)

[github-actions[bot]]

UK AI Open Code Risk & Resilience Governance — Weekly Review

Window: 2026-07-24 → 2026-07-31 (7 days) | Repo: github/gh-aw

1. Executive Summary

352 commits landed in the lookback window, 159 (45%) touched security-relevant surfaces (auth/token handling, secret delivery, path/traversal guards, docker argument validation). Open exposure: 5 code-scanning alerts (all warning severity, none error/critical), 55 open security-labeled issues, 0 open secret-scanning alerts. No new high-priority findings require issue creation this run — every top-tier item identified is already tracked by an existing open issue (see §7). Overall posture: active remediation velocity is good (multiple auth/secret/path-traversal fixes shipped this week), but structural governance gaps remain — no CODEOWNERS, incomplete Dependabot ecosystem coverage for container images, and an unreliable threat-detection reporting pipeline reducing detectability confidence.

2. Asset Graph Summary (recent-change scoped)

Segment	Why in scope	Risk surface
pkg/cli/project_command.go	2 open GraphQL-sprintf-injection warnings (#651/#652), already tracked in #47822	Command injection via unsanitized GraphQL query construction
git_auth_helpers.cjs + fork PR token flow	Multiple commits this week fixing duplicate Authorization header bugs, token fallback chains (AWI_MAINTENANCE_TOKEN/GH_AW_GITHUB_TOKEN)	Token/credential handling correctness
Secret delivery pipeline	Fixes for secret argv exposure, --body - stdin delivery, ADR-48318 draft for secret stdin delivery	Secret exposure via process args/logs
Path/include resolution	ValidatePathWithinBase symlink ancestor bypass fix, .. traversal guard added to fetchIncludeFromSource	Path traversal / write boundary escape
scripts/ensure-docs-slide-pdf.js	Open alert #636 js/http-to-file-access, already tracked in #47630/#43831	Network data written to file (CWE-434/912)
Container images: gh-aw-firewall/*, gh-aw-mcpg, gh-aw-node, github-mcp-server, serena-mcp-server	10+ open container-image-scan issues; libc6 CVE-2026-5450 unpatched (#48405)	Base-image CVE exposure, patch lag
.github/ governance config	No CODEOWNERS (#49167), Dependabot missing docker ecosystem entries for firewall/mcpg images (#49168)	Ownership routing and dependency-update coverage gaps
Threat detection / deep-report pipeline	#49155 — engine repeatedly fails, renders generic banners indistinguishable from real hits	Detectability/observability degradation
actionlint integration	Alert #653 workflow-out-of-context (warning)	Workflow lint context validation gap

Ownership signal: heavy Copilot-authored commit volume with human co-author (pelikhan) on most security fixes — indicates active human review engagement, but no formal CODEOWNERS routing exists yet.

3. Tier Classification Table

Area	Tier	Rationale
CWE-78 command injection findings, pkg/cli/ (141 findings, Sighthound)	B — Open With Conditions	Formal #nosec audit required (#48406); active but incomplete remediation
project_command.go GraphQL sprintf injection (#651/#652)	B	Warning-level, fix already in progress (#47822)
Container images w/ unpatched critical CVE (libc6 CVE-2026-5450)	C — Restricted Pending Review	Critical CVE unpatched in production image (#48405)
Dependabot docker ecosystem gap (firewall/mcpg)	C	Structural coverage gap prevents automated patch signal (#49168)
No CODEOWNERS	C	No enforced review routing for security-sensitive paths (#49167)
Threat-detection/deep-report reliability	C	Detection output indistinguishable from noise — reduces confidence in all other detections (#49155)
ensure-docs-slide-pdf.js network-to-file (#636)	B	Warning-level, scoped to docs build tooling, existing tracked fix
actionlint workflow-out-of-context (#653)	A — Open Safe	Lint-level warning, low exploitability, tooling context only
Secret/auth/path-traversal fixes shipped this week	A (post-fix)	Actively remediated with tests added same week (positive signal)

4. Control Verification Gaps

Domain	Status	Evidence
Ownership	Gap	No .github/CODEOWNERS (#49167) despite security-sensitive paths (pkg/cli/, secret handling, auth helpers)
SDLC	Partial	Active lint/scan coverage (actionlint, CodeQL, Sighthound, zizmor) catching real issues; backlog of 141 CWE-78 findings pending formal audit (#48406)
Dependency	Gap	Dependabot missing docker ecosystem entries for firewall/mcpg images (#49168); unpatched critical CVE in libc6 (#48405)
Secret exposure	Adequate (improving)	This week: secret argv exposure fixed, --body - stdin delivery, ADR-48318 drafted for formal secret-stdin-delivery policy; 0 open secret-scanning alerts
Runtime observability	Gap	Deep-report/threat-detection engine unreliable — failures render as generic banners indistinguishable from real hits (#49155), undermining trust in detection signal
Recovery (patch/rollback)	Partial	Good velocity on code-level fixes (auth headers, path traversal, GraphQL injection in progress) but container CVE patch lag persists (#48405)

5. Risk-Scoring Table

Area	Exposure Amp.	Patchability	Detectability	Op. Fragility	Ownership Conf.	Tier
CWE-78 pkg/cli/ backlog	Med	Med (audit-gated)	Med	Med	Low (no CODEOWNERS)	B
GraphQL sprintf injection	Low-Med	High (fix in flight)	High (CodeQL flagged)	Low	Med	B
Container CVE (libc6)	Med	High (image rebuild)	High (scanner flagged)	Low	Low (dependabot gap)	C
Dependabot ecosystem gap	Low direct / High systemic	High (config change)	Low (silent gap)	Med	Low	C
No CODEOWNERS	Low direct / High systemic	High (add file)	Low	Med	Low	C
Threat-detection unreliability	Med (masks real signal)	Med	Low (self-referential gap)	High	Med	C

6. Remediation Queue

Item	Action	SLA
#48406 CWE-78 backlog	Complete formal #nosec audit, close false positives, patch true positives	High
#48405 libc6 CVE	Rebuild/patch container base images	Critical
#49168 Dependabot gap	Add docker ecosystem entries for firewall/mcpg	High
#49167 CODEOWNERS	Add .github/CODEOWNERS for pkg/cli/, secret/auth helper paths	High
#49155 Deep-report reliability	Fix threat-detection engine so failures are distinguishable from real hits	Medium (quick-win labeled)
#47822 GraphQL injection	Land parameterized query fix for #651/#652	Medium
#47630/#43831 docs script network-to-file	Land fix or accept/annotate risk for #636	Low

7. Duplicate Check / Issue Creation Decision

All highest-priority Tier B/C findings identified this run already have open, non-duplicate tracking issues (#48406, #48405, #49168, #49167, #49155, #47822, #47630). No new issues created this run to avoid duplication — existing issues remain the system of record for remediation tracking.

8. Operational Metrics Baseline

• MTTR proxy: Multiple security fixes (auth headers, path traversal, secret exposure) shipped and merged within days of discovery this week — good velocity for code-level issues; container CVE and governance-config gaps lag (open >7 days).
• Ownership coverage: 0% formal (no CODEOWNERS); informal coverage via consistent human co-author on Copilot-authored security PRs.
• Unsupported/lagging dependency ratio: ≥1 critical unpatched CVE (libc6) in production container images; Dependabot ecosystem coverage incomplete for 2+ container image families.
• Exception aging: No formal exception register entries this run (none required — all findings have active remediation issues, not exceptions).
• Exposure without recovery capability: Threat-detection/observability gap ([deep-report] Threat detection engine repeatedly fails to produce results, rendered as generic banners indistinguishable from a real hit #49155) is the single highest structural risk — it reduces confidence in the org's ability to detect future exposure, independent of patch velocity.

References:

• [uk-ai-resilience] [uk-ai-governance] Tier B: Sighthound CWE-78 (141 findings) — formal #nosec audit required in pkg/cli/ #48406
• [uk-ai-resilience] [uk-ai-governance] Tier C: Unpatched Critical CVEs in container images (libc6 CVE-2026-5450) #48405
• [deep-report] Threat detection engine repeatedly fails to produce results, rendered as generic banners indistinguishable from a real hit #49155

Generated by UK AI Operational Resilience · auto · 42.8 AIC · ⌖ 8.71 AIC · ⊞ 8.8K · ◷

• expires on Aug 3, 2026, 8:13 AM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by UK AI Operational Resilience.

A newer discussion is available at Discussion #50032.