[CI/CD Security] fluttercandies/json_dart - Issue Report

[github-actions]

📦 fluttercandies/json_dart

📌 Commit SHA: 6f6ec21ce1085cb55ccb8443e86b70be05a5a5d1

🕜 Report generated at: 2026-08-14T06:40:34.380Z

🔍 Overview

Severity	Count
🟡 Medium	5
🟢 Low	2
ℹ️ Informational	3

📁 Details

📄 .github/workflows/build-apps.yml - 🟡Medium(4) ℹ️Informational(3)

1	Severity	Audit Rule	Confidence
	🟡 Medium	excessive-permissions	Medium
Audit: overly broad permissions: default permissions used due to no permissions: block Remediation: view audit

• .github/workflows/build-apps.yml#L1-L132
  Audit: default permissions used due to no permissions: block

  name: Build Apps
  
  concurrency:
    group: ${{ github.workflow }}-${{ github.ref }}
    cancel-in-progress: true
  
  ...

---

2	Severity	Audit Rule	Confidence
	🟡 Medium	excessive-permissions	Medium
Audit: overly broad permissions: default permissions used due to no permissions: block Remediation: view audit

• .github/workflows/build-apps.yml#L22-L61
  Audit: this job

    build-apks-and-linux-app:
      name: Release Apks/LinuxApp
      runs-on: ubuntu-latest
      steps:
        - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3
          with:
  ...

• .github/workflows/build-apps.yml#L22-L61
  Audit: default permissions used due to no permissions: block

    build-apks-and-linux-app:
      name: Release Apks/LinuxApp
      runs-on: ubuntu-latest
      steps:
        - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3
          with:
  ...

---

3	Severity	Audit Rule	Confidence
	🟡 Medium	excessive-permissions	Medium
Audit: overly broad permissions: default permissions used due to no permissions: block Remediation: view audit

• .github/workflows/build-apps.yml#L63-L87
  Audit: this job

    build-windows-app:
      name: Release Windows
      runs-on: windows-latest
      steps:
        - uses: actions/checkout@0717577d45739eb3c851188b29f50ed6c0b2194e # v2
          with:
  ...

• .github/workflows/build-apps.yml#L63-L87
  Audit: default permissions used due to no permissions: block

    build-windows-app:
      name: Release Windows
      runs-on: windows-latest
      steps:
        - uses: actions/checkout@0717577d45739eb3c851188b29f50ed6c0b2194e # v2
          with:
  ...

---

4	Severity	Audit Rule	Confidence
	🟡 Medium	excessive-permissions	Medium
Audit: overly broad permissions: default permissions used due to no permissions: block Remediation: view audit

• .github/workflows/build-apps.yml#L89-L132
  Audit: this job

    build-macos-app:
      name: Release MacOS
      runs-on: macos-latest
      steps:
        - uses: actions/checkout@0717577d45739eb3c851188b29f50ed6c0b2194e # v2
          with:
  ...

• .github/workflows/build-apps.yml#L89-L132
  Audit: default permissions used due to no permissions: block

    build-macos-app:
      name: Release MacOS
      runs-on: macos-latest
      steps:
        - uses: actions/checkout@0717577d45739eb3c851188b29f50ed6c0b2194e # v2
          with:
  ...

---

5	Severity	Audit Rule	Confidence
	ℹ️ Informational	superfluous-actions	High
Audit: action functionality is already included by the runner: use `gh release` in a script step Remediation: view audit

• .github/workflows/build-apps.yml#L55
  Audit: this step

  name: Release to github

• .github/workflows/build-apps.yml#L56
  Audit: use gh release in a script step

  ncipollo/release-action@339a81892b84b4eeb0f6e744e4574d79d0d9b8dd

---

6	Severity	Audit Rule	Confidence
	ℹ️ Informational	superfluous-actions	High
Audit: action functionality is already included by the runner: use `gh release` in a script step Remediation: view audit

• .github/workflows/build-apps.yml#L81
  Audit: this step

  name: Release build

• .github/workflows/build-apps.yml#L82
  Audit: use gh release in a script step

  ncipollo/release-action@339a81892b84b4eeb0f6e744e4574d79d0d9b8dd

---

7	Severity	Audit Rule	Confidence
	ℹ️ Informational	superfluous-actions	High
Audit: action functionality is already included by the runner: use `gh release` in a script step Remediation: view audit

• .github/workflows/build-apps.yml#L124
  Audit: this step

  name: Release build

• .github/workflows/build-apps.yml#L125
  Audit: use gh release in a script step

  ncipollo/release-action@339a81892b84b4eeb0f6e744e4574d79d0d9b8dd

---

📄 .github/workflows/deploy-web.yml - 🟡Medium(1) 🟢Low(2)

1	Severity	Audit Rule	Confidence
	🟡 Medium	excessive-permissions	Medium
Audit: overly broad permissions: default permissions used due to no permissions: block Remediation: view audit

• .github/workflows/deploy-web.yml#L1-L41
  Audit: default permissions used due to no permissions: block

  name: Deploy Web
  
  concurrency:
    group: ${{ github.workflow }}-${{ github.ref }}
    cancel-in-progress: true
  
  ...

---

2	Severity	Audit Rule	Confidence
	🟢 Low	template-injection	High
Audit: code injection via template expansion: may expand into attacker-controllable code Remediation: view audit

• .github/workflows/deploy-web.yml#L40
  Audit: may expand into attacker-controllable code

  |
            cd apps/jsond
            flutter build web --release --tree-shake-icons
            dart scripts/web.dart
            cp -a .vercel build/web
            cd build/web
  ...

• .github/workflows/deploy-web.yml#L33
  Audit: this run block

  run

---

3	Severity	Audit Rule	Confidence
	🟢 Low	adhoc-packages	High
Audit: ad-hoc installation of packages: installs a package outside of a lockfile Remediation: view audit

• .github/workflows/deploy-web.yml#L33
  Audit: this step

  run

• .github/workflows/deploy-web.yml#L39
  Audit: installs a package outside of a lockfile

  |
            cd apps/jsond
            flutter build web --release --tree-shake-icons
            dart scripts/web.dart
            cp -a .vercel build/web
            cd build/web
  ...

---