Security Advisory: Self-Hosted Runner Risk (Skor: 20/100)

Security Advisory: Self-Hosted Runner Risk Tespit Edildi

Merhaba,

Bu repo'da self-hosted GitHub Actions runner kullanildigi ve riskli trigger'larin bulundugu tespit edilmistir.

Tespit Edilen Sorunlar

• Risk Skoru: 20/100
• Trigger'lar: 1 workflow'da self-hosted runner var
• Workflow'lar (1 adet):
  • deploy.yml

Oneriler

1. Self-hosted runner kullaniyorsaniz, runner'in guvenlik yamalarinin guncel oldugundan emin olun.
2. Riskli trigger'lar (pull_request_target, issue_comment, workflow_run, repository_dispatch) kullaniyorsaniz, ek guvenlik onlemleri alin:
   • pull_request_target icin: base branch'i checkout ederken PR koduyla calismayin
   • issue_comment icin: sadece yetkili kullanicilarin trigger'layabildiginden emin olun
   • workflow_run icin: calisma ortamini kistlayin
3. Runner erisimini sadece guvenilir workflow'larla sinirlandirin.
4. Runner'in ag erisimini kistlayin.
5. Token'larinizi sifreli sekilde (GitHub Secrets) saklayin.

Detayli dokuman: https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions

Bu mesaj, guvenlik amaciyla otomatik olarak gonderilmistir. Herkesin bilgisayari guvende olsun.

Start by inspecting the deploy.yml workflow and reviewing the linked GitHub Actions security-hardening guidance. Confirm which runner and trigger settings create the reported risk, then clarify the intended mitigation with maintainers. Done should mean the agreed security changes are applied and the workflow no longer has the reported exposure.