Vulnerabilities And Secrets Do Not Raise Alerts #1120

Activity

1. abbiemery commented on Feb 25, 2026

   

   abbiemery

   on Feb 25, 2026

   Last edited by abbiemery

   Contributor

   More actions

   @dan-fernandes Is this covered by the gitleaks lint?
2. abbiemery

   added

   ciPull requests that update GitHub Actions codePull requests that update GitHub Actions code

   needs confirmationDoes this bug still exist?Does this bug still exist?

   on Feb 25, 2026
3. dan-fernandes commented on Mar 2, 2026

   

   dan-fernandes

   on Mar 2, 2026

   ContributorAuthor

   More actions

   I've re-created the vulnerabilities PR and got this warning on push:

   $     git push --set-upstream origin 1120-add-critical-vulnerabilities
   Enumerating objects: 45, done.
   Counting objects: 100% (45/45), done.
   Delta compression using up to 22 threads
   Compressing objects: 100% (30/30), done.
   Writing objects: 100% (35/35), 2.92 KiB | 995.00 KiB/s, done.
   Total 35 (delta 23), reused 0 (delta 0), pack-reused 0
   remote: Resolving deltas: 100% (23/23), completed with 8 local objects.
   remote: 
   remote: Create a pull request for '1120-add-critical-vulnerabilities' on GitHub by visiting:
   remote:      https://github.com/DiamondLightSource/blueapi/pull/new/1120-add-critical-vulnerabilities
   remote: 
   remote: GitHub found 1 vulnerability on DiamondLightSource/blueapi's default branch (1 high). To find out more, visit:
   remote:      https://github.com/DiamondLightSource/blueapi/security/dependabot/29
   remote: 
   To github.com:DiamondLightSource/blueapi.git
    * [new branch]          1120-add-critical-vulnerabilities -> 1120-add-critical-vulnerabilities
   branch '1120-add-critical-vulnerabilities' set up to track 'origin/1120-add-critical-vulnerabilities'.
   
4. dan-fernandes commented on Mar 2, 2026

   

   dan-fernandes

   on Mar 2, 2026

   ContributorAuthor

   More actions

   The PR passes all CI, including CodeQL, so the issue is still open.

   
5. ZohebShaikh commented on Mar 2, 2026

   

   ZohebShaikh

   on Mar 2, 2026

   Contributor

   More actions

   I had a look at CodeQL earlier it is for a different thing and the reason it is passing is we have not added any checks to it.
   And it mostly is used to avoid regression of security vulnerabilities in Application Code. The comment where I have explained this more here

   For gitleaks, The reason it did not flag this was it thought the things that you are adding are false positives more details here

   I have seen gitleaks flag api-key etc