Security review: commits since 2026-05-11

## Scope

Reviewed all commits to this repository between 2026-05-11 00:00 UTC and 2026-05-18, per the code-freeze directive.

**Full commit view (GitHub UI):** https://github.com/grafana/interactive-tutorials/commits/main/?since=2026-05-11&until=2026-05-18

## Methodology

1. Enumerated all commits in the window across all branches (`git log --since="2026-05-11" --until="2026-05-18" --all`).
2. AI-assisted commit-diff sweep + deep malicious-code review covering: backdoors / auth bypass, data exfiltration, persistence, supply-chain compromise, CI/CD tampering, obfuscation, cryptojacking / wallet drainers, hidden files, web shell / reverse shell patterns. Extra attention paid to tutorial JSON content (URLs, iframes, script tags, CSS selectors).
3. Cross-referenced PR numbers and author identities against the team roster.
4. Human review and sign-off.

## Commits reviewed (main, 7)

| SHA | Author | Summary | Verdict |
| --- | ------ | ------- | ------- |
| `16aac3d` | Jay Clifford (merge of d70c6e9 by Michael Wettick) | IRM selector refresh (#309) | clean |
| `adddfba` | Jay Clifford | play-5k-run selector fix (#307) | clean |
| `ac08944` | Simon Prickett | NZ GeoNet play tour (#214) | clean |
| `97a9368` | Simon Prickett | CheerLights dashboard tour (#303) | clean |
| `adcd8b4` | Simon Prickett | GB-Railways selector fix (#310) | clean |
| `cda0e0c` | Simon Prickett | NZ Geonet selector fix (#311) | clean |
| `24f6998` | David Allen | Pathfinder docs parity + audit/update-guide skills (#308) | clean — docs only |

## External contributors

- **Michael Wettick** (`d70c6e9`, merged via #309) — established contributor with 9 prior commits to this repo going back to 2025-11-07. Commit is a 4-selector refresh in `irm-configuration/content.json:117-145`, moving from `data-pathfinder` attributes to `div:text("...")` / `data-testid` selectors. No new URLs, no `action` changes, no new fields.

## Notable items examined

- **PR #308 (`24f6998`)** — 25-file change is docs-only: `.cursor/*.mdc`, `.cursor/skills/*.md`, `AGENTS.md`, `CLAUDE.md`, `docs/*.md`. No executable file added. The misleadingly-named `.cursor/commands/attack.md` is a Cursor prompt that instructs the AI to role-play a confused user for tutorial UX stress-testing.
- **All new URLs are Grafana-owned**: `grafana.com/docs/learning-paths/*`, `interactive-learning.grafana.net/courses/{oss,cloud}.json`, `github.com/grafana/grafana-pathfinder-app`, plus `http://localhost/health` in a docs example. No off-domain hosts.
- **New tutorial JSON** (`play-cheerlights`, `play-nz-geonet-tour`) contains no `iframe`, ``, `javascript:`, `onerror=`, or off-domain URLs. Only `markdown`, `interactive`, and `section` blocks targeting `data-testid` selectors.
- **Side-branch `feat/courses-cdn` (not on main)** — adds a CDN publish step using `grafana/shared-workflows/actions/push-to-gcs@0527786f572985731b4bde3684d82567abe8e979 # push-to-gcs/v0.3.0` (SHA-pinned), same Grafana service account and bucket prefix as existing steps. Worth re-verifying when it merges: the `pathfinder-app/dist/cli/cli/index.js build-courses` invocation should execute from a vendored submodule, not fetch arbitrary code at CI time.

## Findings

**No malicious code detected.**

## Reviewer

@Jayclifford345 — 2026-05-18

## Next steps

- [x] Commit review complete
- [x] Issue filed
- [ ] Tracking spreadsheet updated to "Complete" / "Reviewed By: Jay Clifford"
- [ ] Restoration requested in #i-2026-05-16-coinbasecartel-claimed-access-to-grafana-data