Public Security Audits

A SOC 2 Type II auditor reviewing this codebase would flag SQL injection patterns under CC6.1 and CC6.6, and plain-text secret storage under CC6.7. These findings typically trigger a qualified opinion or require additional compensating controls — delaying certification by weeks and adding remediation cost discovered late in the audit cycle. The SSRF vector in an authenticated endpoint would additionally surface under CC7.1 as an unmonitored external communication channel.

• How are database credentials and API secrets managed across environments?
• Is there a centralized secret rotation policy with documented evidence?
• Are outbound HTTP requests from the application logged and monitored?
• What controls prevent unauthenticated access to streaming or media endpoints?

• Discovered during audit → Management letter issued, compensating controls required before opinion issued, certification delayed.
• Discovered post-report → Customer notification obligation triggered, trust service criteria re-evaluated, re-audit scope expansion.
• Exploited in production → Incident disclosure requirement under applicable data protection law, potential breach of customer SLA.

Any team using MegaLinter in their CI/CD pipeline inherited this injection vector. Under SOC 2, an unpatched CI/CD script injection falls under CC8.1 — change management controls — and CC6.6 — logical access controls over infrastructure. An auditor discovering this post-certification would require immediate remediation evidence and could trigger a scope expansion. Teams relying on MegaLinter for their own compliance pipelines were unknowingly running a compromised gatekeeper.

• How are third-party CI/CD tools vetted before being introduced into the pipeline?
• Is there a process for monitoring upstream dependency vulnerabilities in workflow tooling?
• What evidence exists that pull request inputs are sanitized before use in shell execution?
• Are pipeline secrets scoped to minimum privilege and rotated on a documented schedule?

• Discovered during audit → CC8.1 finding raised, change management controls deemed insufficient, auditor requires pipeline remediation evidence before issuing opinion.
• Discovered post-report → Inherited vulnerability from third-party tool triggers scope re-evaluation, potential management letter addendum.
• Exploited in production → Attacker gains persistent access to CI environment and secrets store via malicious PR title — full pipeline compromise.