Please don't open a public issue for a vulnerability in ci-agent-audit. Use the Report a vulnerability button on the repository's Security tab so it stays private while it is fixed.

Include the affected version, the steps to reproduce it, and the impact you expect.

If the tool misses a risky workflow pattern or flags a safe one, that is a detection issue, not a vulnerability. Open a regular issue with a minimal workflow, and remove any private names or secrets first.

A finding from this tool is a pattern to check, not a confirmed exploit. If you find a real problem in someone else's project, report it to that project privately and give them time to fix it before you share it.

This project is in pre-release. Only the latest version receives fixes.