All issues

Search results

Security: operations alert triage creates a new issue every 30 min with no dedup, and EventBridge patterns lack errorCode filter, letting denied AWS calls amplify the alert stream (CICD-SEC-1 — Low)

aws

security

Status: Open.

Task

#190 In VilnaCRM-Org/bootstrap-infrastructure;

· Kravalg opened on Jul 5, 2026

Security: no per-actor or repo-wide rate limit on PR-comment Pulumi pipelines enables denial-of-wallet / CI-minute fan-out (CICD-SEC-1 — Low)

ci

security

Status: Open.

Task

#189 In VilnaCRM-Org/bootstrap-infrastructure;

· Kravalg opened on Jul 5, 2026

Security: branch ruleset does not dismiss stale approvals on push or require last-push approval, enabling post-approval commit injection (CICD-SEC-1 — Low)

ci

security

Status: Open.

Task

#188 In VilnaCRM-Org/bootstrap-infrastructure;

· Kravalg opened on Jul 5, 2026

Security: Pulumi state, Config, and central-logging buckets use SSE-S3 (AES256) not a CMK, and the encryption guardrail accepts any sseAlgorithm (A02:2021 / CKV_AWS_145 — Low)

aws

security

Status: Open.

Task

#187 In VilnaCRM-Org/bootstrap-infrastructure;

· Kravalg opened on Jul 5, 2026

Security: audit/state/backup stores lack immutability (no S3 Object Lock, MFA-Delete, or Backup Vault Lock) and object deletion is unmonitored (A09:2021 — Low)

aws

enhancementNew feature or requestNew feature or request

security

Status: Open.

Task

#186 In VilnaCRM-Org/bootstrap-infrastructure;

· Kravalg opened on Jul 5, 2026

Security: PR guardrails/runner execute untrusted same-repo PR-head code with AWS OIDC and PULUMI_ACCESS_TOKEN, with no in-workflow reviewed-PR requirement (CICD-SEC-4 — Medium)

aws

ci

security

Status: Open.

Task

#185 In VilnaCRM-Org/bootstrap-infrastructure;

· Kravalg opened on Jul 5, 2026

Security: destructive-infrastructure safety gate is bypassable by a PR label triage-level users can apply (CICD-SEC-1 — High)

ci

security

Status: Open.

Task

#184 In VilnaCRM-Org/bootstrap-infrastructure;

· Kravalg opened on Jul 5, 2026

Security: PR-comment runner ignores shared state concurrency group and auto-pulumi cancel escalates lock races into Pulumi state corruption (CICD-SEC-1 — High)

ci

ci-health

quality

security

Status: Open.

Task

#183 In VilnaCRM-Org/bootstrap-infrastructure;

· Kravalg opened on Jul 5, 2026

Security: automation OIDC role can self-escalate to account admin via iam:PutRolePolicy on its own ARN (CICD-SEC-5 — High)

architecture

aws

ci

security

Status: Open.

Task

#182 In VilnaCRM-Org/bootstrap-infrastructure;

· Kravalg opened on Jul 5, 2026

Security: /pulumi PR-comment authorization trusts author_association, letting read/triage collaborators & org members trigger AWS applies (CICD-SEC-1 — High)

ci

security

Status: Open.

Task

#181 In VilnaCRM-Org/bootstrap-infrastructure;

· Kravalg opened on Jul 5, 2026

[ci-gap][ci-health] Serialize all stack-mutating jobs on per-environment concurrency groups (ChatOps runner races deploys)

ci

ci-health

quality

Status: Open.

#180 In VilnaCRM-Org/bootstrap-infrastructure;

· Kravalg opened on Jul 5, 2026

[ci-gap][performance] Run the cost/quota proxy gate on deploy paths, not only PR guardrails

ci

performance

quality

Status: Open.

#179 In VilnaCRM-Org/bootstrap-infrastructure;

· Kravalg opened on Jul 5, 2026