Security Rules

Sentinel scans for the following vulnerability patterns:

• allow-forks-artifact
• build-publish-same-job
• cache-poisoning
• credential-window
• curl-pipe-shell
• dangerous-lifecycle-scripts
• dangerous-triggers
• docker-build-arg-secrets
• excessive-permissions
• git-config-global
• github-dependency-refs
• github-script-injection
• hardcoded-secrets
• ide-config-injection
• jq-arg-escape-sequences
• missing-dependabot
• missing-env-protection
• missing-frozen-lockfile
• missing-permissions
• missing-persist-credentials
• missing-timeouts
• missing-zizmor
• overly-broad-triggers
• self-hosted-runner-fork
• shell-injection-expr
• shell-injection-jq
• static-aws-credentials
• unpinned-actions
• unpinned-artifact
• unpinned-docker-image
• unscoped-app-token
• workflow-dispatch-injection

Sentinel — open-source CI/CD security scanner. Source