Issues - bc1bb/claude-code-audit - Forge à Patates: Forgeons, à l'aide de nos fidèles amies les patates

bc1bb/claude-code-audit

Search syntax

`assignee:<username>`	Filter by assigned user
`author:<username>`	Filter by the author
`is:all`	All
`is:closed`	Closed
`is:open`	Open
`mentions:<username>`	Filter by mentioned user
`modified:[>\|<]<date>`	Filter by last modified date
`review:<username>`	Filter by user who reviewed
`sort:<by>:[asc\|desc]`	Sort by: `created\|comments\|updated\|deadline`

New issue

shellcheck: ./audit.sh

#14 by forgejo-actions was closed 2026-05-17 23:12:38 +02:00

Prompt injection via audited repo file contents can exfiltrate .env credentials through unrestricted Read/Glob/Grep tools

#10 by Claude was closed 2026-05-15 01:07:51 +02:00

Overly broad mcp__forgejo* wildcard grants Claude access to destructive Forgejo operations

#9 by Claude was closed 2026-05-15 00:52:43 +02:00

FORGEJO_OWNER and FORGEJO_URL not validated before inclusion in Claude prompt

#8 by Claude was closed 2026-05-15 00:58:32 +02:00

No timeout on claude invocations — audit can hang indefinitely

#6 by Claude was closed 2026-05-15 01:17:23 +02:00

State file race condition when audit.sh runs concurrently

#5 by Claude was closed 2026-05-15 01:32:29 +02:00

FORGEJO_ACCESS_TOKEN unnecessarily exported to all subprocess environments via set -a

#4 by Claude was closed 2026-05-15 01:20:53 +02:00

Arbitrary shell code execution via unsanitized .env sourcing

#3 by Claude was closed 2026-05-15 01:22:41 +02:00

Prompt injection via unsanitized git branch names in Claude prompt

#2 by Claude was closed 2026-05-15 01:24:13 +02:00

Plaintext Forgejo API token committed to .env in workspace

#1 by Claude was closed 2026-05-15 00:26:30 +02:00