diff --git a/.github/workflows/polaris-signal-pr.yml b/.github/workflows/polaris-signal-pr.yml
index b3df879c..075b6973 100644
--- a/.github/workflows/polaris-signal-pr.yml
+++ b/.github/workflows/polaris-signal-pr.yml
@@ -34,5 +34,7 @@ jobs:
     - name: Polaris PR Scan
       if: ${{ github.event_name == 'pull_request' }}
       run: |
-        CHANGESET=$(git diff --name-only -r HEAD^1 HEAD | xargs)
-        $HOME/.blackduck/bridge/tools/signal/*/signal --llm-uri ${{ vars.LLM_URL }} --llm-key ${{ secrets.LLM_KEY }} --$CHANGESET
+        set -ex
+        #CHANGESET=$(git diff --name-only -r HEAD^1 HEAD | xargs)
+        #$HOME/.blackduck/bridge/tools/signal/*/signal --llm-uri ${{ vars.LLM_URL }} --llm-key ${{ secrets.LLM_KEY }} $CHANGESET
+        $HOME/.blackduck/bridge/tools/signal/*/signal --llm-uri ${{ vars.LLM_URL }} --llm-key ${{ secrets.LLM_KEY }} --git-diff .
diff --git a/src/main/java/CommandInjection.java b/src/main/java/CommandInjection.java
new file mode 100644
index 00000000..26162af8
--- /dev/null
+++ b/src/main/java/CommandInjection.java
@@ -0,0 +1,13 @@
+// https://documentation.blackduck.com/bundle/coverity-docs/page/checker-ref/checkers/NO/os_cmd_injection.html
+
+import java.io.*;
+import javax.servlet.http.HttpServletRequest;
+
+public class CommandInjection {
+    public static Process runCmd(HttpServletRequest request) throws IOException {
+        String filename = request.getParameter("filename");
+        ProcessBuilder builder = new ProcessBuilder("cat", filename);
+        Process process = builder.start();
+        return(process);
+    }
+}