One run of PIPEFIX against a repository carrying 1 pipeline platforms (GitHub Actions) and 10254 source, config and container files. It found 262 critical, 317 high and 724 medium issues, fixed 335 of them itself in a branch, wrote change records for the 966 that need a human decision, then re-scanned: every pipeline file still parses, 332 fixes are confirmed gone, and 2 new findings surfaced after the fix (queued for the next pass). This is the real output against our own product repository, not a mock-up.
What it caught: 140 credential patterns, 1091 records that look like patient or personal data, and 72 pipeline and infrastructure weaknesses. Most of the personal-data hits sit in demo and test scripts we ship deliberately, which is exactly the point: PIPEFIX catches sample records before they reach a client, the same way it catches a real one.
FIXED means every issue PIPEFIX found in that pipeline was corrected and the re-scan confirmed it. FOR YOU means the only items left are change records that need your value or decision.
| Pipeline | Found | Critical | High | Medium | Low | Fixed | Verified | For you | Status |
|---|---|---|---|---|---|---|---|---|---|
| GitHub Actions | 5 | 0 | 1 | 4 | 0 | 1 | 1 | 4 | 4 FOR YOU |
| Source code, config and containers | 1298 | 262 | 316 | 720 | 0 | 334 | 331 | 962 | FAIL · 2 open |
Critical first, showing 150 of 1,303; the full list is in the report and the dashboard. “Fixed & verified” means PIPEFIX changed the file, re-ran the scan and the issue was gone. “Change record” means the fix needs a value or a decision only you have, and PIPEFIX wrote the exact steps instead of guessing.
| Severity | Issue | Where | Pack | Outcome |
|---|---|---|---|---|
| critical | Payment card number (Luhn-valid) Identifiers hard-coded in application code indicate PHI handled outside a controlled data store. Review the data flow. | Build-FullVulnAzure.ps1:19 | PHI | Fixed & verified |
| critical | Payment card number (Luhn-valid) Identifiers hard-coded in application code indicate PHI handled outside a controlled data store. Review the data flow. | Build-FullVulnAzure.ps1:19 | PHI | Fixed & verified |
| critical | Database connection string with password A credential in source or pipeline definition is readable by every person and process with repository access, and by anyone who ever clones the history. Rotate it and load it from a secret store. | Build-Phase3-Final.ps1:13 | SECRETS | Fixed & verified |
| critical | Database connection string with password A credential in source or pipeline definition is readable by every person and process with repository access, and by anyone who ever clones the history. Rotate it and load it from a secret store. | Build-Phase3-FullBugs.ps1:20 | SECRETS | Fixed & verified |
| critical | Database connection string with password A credential in source or pipeline definition is readable by every person and process with repository access, and by anyone who ever clones the history. Rotate it and load it from a secret store. | Build-Phase3-FullBugs.ps1:57 | SECRETS | Fixed & verified |
| critical | AWS access key ID A credential in source or pipeline definition is readable by every person and process with repository access, and by anyone who ever clones the history. Rotate it and load it from a secret store. | Build-Phase3-FullBugs.ps1:90 | SECRETS | Fixed & verified |
| critical | AWS secret access key A credential in source or pipeline definition is readable by every person and process with repository access, and by anyone who ever clones the history. Rotate it and load it from a secret store. | Build-Phase3-FullBugs.ps1:90 | SECRETS | Fixed & verified |
| critical | Azure AD / Entra client secret A credential in source or pipeline definition is readable by every person and process with repository access, and by anyone who ever clones the history. Rotate it and load it from a secret store. | Build-Phase3-FullBugs.ps1:90 | SECRETS | Fixed & verified |
| critical | Database connection string with password A credential in source or pipeline definition is readable by every person and process with repository access, and by anyone who ever clones the history. Rotate it and load it from a secret store. | Build-Phase3-Retry.ps1:25 | SECRETS | Fixed & verified |
| critical | US Social Security Number Identifiers hard-coded in application code indicate PHI handled outside a controlled data store. Review the data flow. | Test-AllTiers-LiveAzure.ps1:65 | PHI | Fixed & verified |
| critical | Payment card number (Luhn-valid) Identifiers hard-coded in application code indicate PHI handled outside a controlled data store. Review the data flow. | Test-AllTiers-LiveAzure.ps1:65 | PHI | Open |
| critical | Database connection string with password A credential in source or pipeline definition is readable by every person and process with repository access, and by anyone who ever clones the history. Rotate it and load it from a secret store. | Test-AllTiers-LiveAzure.ps1:90 | SECRETS | Fixed & verified |
| critical | US Social Security Number Identifiers hard-coded in application code indicate PHI handled outside a controlled data store. Review the data flow. | _backups/v196-prod-ready-20260425/agents/oracle_portal_pack.py:1137 | PHI | Fixed & verified |
| critical | US Social Security Number Identifiers hard-coded in application code indicate PHI handled outside a controlled data store. Review the data flow. | _backups/v196-prod-ready-20260425/agents/oracle_portal_pack.py:1152 | PHI | Fixed & verified |
| critical | Database connection string with password A credential in source or pipeline definition is readable by every person and process with repository access, and by anyone who ever clones the history. Rotate it and load it from a secret store. | _backups/v196-prod-ready-20260425/demo/azure-demo-create.ps1:141 | SECRETS | Fixed & verified |
| critical | Database connection string with password A credential in source or pipeline definition is readable by every person and process with repository access, and by anyone who ever clones the history. Rotate it and load it from a secret store. | agents/_airgap_certify.py:129 | SECRETS | Fixed & verified |
| critical | Database connection string with password A credential in source or pipeline definition is readable by every person and process with repository access, and by anyone who ever clones the history. Rotate it and load it from a secret store. | agents/_guardrails.py:194 | SECRETS | Fixed & verified |
| critical | Database connection string with password A credential in source or pipeline definition is readable by every person and process with repository access, and by anyone who ever clones the history. Rotate it and load it from a secret store. | agents/_guardrails.py:224 | SECRETS | Fixed & verified |
| critical | US Social Security Number Identifiers hard-coded in application code indicate PHI handled outside a controlled data store. Review the data flow. | agents/healthcare_phi_audit.py:361 | PHI | Fixed & verified |
| critical | US Social Security Number Identifiers hard-coded in application code indicate PHI handled outside a controlled data store. Review the data flow. | agents/healthcare_phi_audit.py:366 | PHI | Fixed & verified |
| critical | US Social Security Number Identifiers hard-coded in application code indicate PHI handled outside a controlled data store. Review the data flow. | agents/healthcare_phi_audit.py:392 | PHI | Fixed & verified |
| critical | US Social Security Number Identifiers hard-coded in application code indicate PHI handled outside a controlled data store. Review the data flow. | agents/oracle_portal_pack.py:1289 | PHI | Fixed & verified |
| critical | US Social Security Number Identifiers hard-coded in application code indicate PHI handled outside a controlled data store. Review the data flow. | agents/oracle_portal_pack.py:1304 | PHI | Fixed & verified |
| critical | US Social Security Number Identifiers hard-coded in application code indicate PHI handled outside a controlled data store. Review the data flow. | agents/oracle_portal_pack.py:1338 | PHI | Fixed & verified |
| critical | Database connection string with password A credential in source or pipeline definition is readable by every person and process with repository access, and by anyone who ever clones the history. Rotate it and load it from a secret store. | agents/pipefix_engine/connectors.py:400 | SECRETS | Fixed & verified |
| critical | Payment card number (Luhn-valid) Identifiers hard-coded in application code indicate PHI handled outside a controlled data store. Review the data flow. | agents/pipefix_engine/fixer.py:324 | PHI | Open |
| critical | Database connection string with password A credential in source or pipeline definition is readable by every person and process with repository access, and by anyone who ever clones the history. Rotate it and load it from a secret store. | agents/snowflake_lattice.py:727 | SECRETS | Fixed & verified |
| critical | Storage allows anonymous / public blob access Public blob access exposes every container to the internet. | demo/audit-live-proof/tier-run.json:192 | PIPELINE | Fixed & verified |
| critical | Storage allows anonymous / public blob access Public blob access exposes every container to the internet. | demo/audit-live-proof/tier-run.json:214 | PIPELINE | Fixed & verified |
| critical | Storage allows anonymous / public blob access Public blob access exposes every container to the internet. | demo/audit-live-proof/tier-run.json:583 | PIPELINE | Fixed & verified |
| critical | Storage allows anonymous / public blob access Public blob access exposes every container to the internet. | demo/audit-live-proof/tier-run.json:646 | PIPELINE | Fixed & verified |
| critical | Storage allows anonymous / public blob access Public blob access exposes every container to the internet. | demo/audit-live-proof/tier-run.json:1527 | PIPELINE | Fixed & verified |
| critical | Storage allows anonymous / public blob access Public blob access exposes every container to the internet. | demo/audit-live-proof/tier-run.json:1590 | PIPELINE | Fixed & verified |
| critical | Storage allows anonymous / public blob access Public blob access exposes every container to the internet. | demo/audit-live-proof/tier-run.json:2479 | PIPELINE | Fixed & verified |
| critical | Storage allows anonymous / public blob access Public blob access exposes every container to the internet. | demo/audit-live-proof/tier-run.json:2542 | PIPELINE | Fixed & verified |
| critical | Storage allows anonymous / public blob access Public blob access exposes every container to the internet. | demo/audit-live-proof/tier-run.json:3425 | PIPELINE | Fixed & verified |
| critical | Storage allows anonymous / public blob access Public blob access exposes every container to the internet. | demo/audit-live-proof/tier-run.json:3488 | PIPELINE | Fixed & verified |
| critical | Storage allows anonymous / public blob access Public blob access exposes every container to the internet. | demo/audit-live-proof/tier-run.json:4377 | PIPELINE | Fixed & verified |
| critical | Storage allows anonymous / public blob access Public blob access exposes every container to the internet. | demo/audit-live-proof/tier-run.json:4440 | PIPELINE | Fixed & verified |
| critical | Storage allows anonymous / public blob access Public blob access exposes every container to the internet. | demo/audit-live-proof/tier-run.json:5323 | PIPELINE | Fixed & verified |
| critical | Storage allows anonymous / public blob access Public blob access exposes every container to the internet. | demo/audit-live-proof/tier-run.json:5386 | PIPELINE | Fixed & verified |
| critical | Storage allows anonymous / public blob access Public blob access exposes every container to the internet. | demo/audit-live-proof/tier-run.json:6341 | PIPELINE | Fixed & verified |
| critical | Storage allows anonymous / public blob access Public blob access exposes every container to the internet. | demo/audit-live-proof/tier-run.json:6410 | PIPELINE | Fixed & verified |
| critical | Storage allows anonymous / public blob access Public blob access exposes every container to the internet. | demo/audit-live-proof/tier-run.json:7341 | PIPELINE | Fixed & verified |
| critical | Storage allows anonymous / public blob access Public blob access exposes every container to the internet. | demo/audit-live-proof/tier-run.json:7404 | PIPELINE | Fixed & verified |
| critical | Storage allows anonymous / public blob access Public blob access exposes every container to the internet. | demo/audit-live-proof/tier-run.json:8285 | PIPELINE | Fixed & verified |
| critical | Storage allows anonymous / public blob access Public blob access exposes every container to the internet. | demo/audit-live-proof/tier-run.json:8348 | PIPELINE | Fixed & verified |
| critical | Storage allows anonymous / public blob access Public blob access exposes every container to the internet. | demo/audit-live-proof/tier-run.json:8743 | PIPELINE | Fixed & verified |
| critical | Storage allows anonymous / public blob access Public blob access exposes every container to the internet. | demo/audit-live-proof/tier-run.json:8789 | PIPELINE | Fixed & verified |
| critical | Database connection string with password A credential in source or pipeline definition is readable by every person and process with repository access, and by anyone who ever clones the history. Rotate it and load it from a secret store. | demo/azure-demo-create.ps1:141 | SECRETS | Fixed & verified |
| critical | Database connection string with password A credential in source or pipeline definition is readable by every person and process with repository access, and by anyone who ever clones the history. Rotate it and load it from a secret store. | demo/snowflake-demo-create.ps1:67 | SECRETS | Fixed & verified |
| critical | Database connection string with password A credential in source or pipeline definition is readable by every person and process with repository access, and by anyone who ever clones the history. Rotate it and load it from a secret store. | demo/snowflake-demo-create.ps1:69 | SECRETS | Fixed & verified |
| critical | Database connection string with password A credential in source or pipeline definition is readable by every person and process with repository access, and by anyone who ever clones the history. Rotate it and load it from a secret store. | demo/snowflake-demo-create.ps1:95 | SECRETS | Fixed & verified |
| critical | US Social Security Number Real patient / person identifiers in source, tests or seed data are a HIPAA disclosure the moment the repo is cloned. Replace with synthetic values. | demo/snowflake-demo-create.ps1:149 | PHI | Fixed & verified |
| critical | Database connection string with password A credential in source or pipeline definition is readable by every person and process with repository access, and by anyone who ever clones the history. Rotate it and load it from a secret store. | demo/snowflake-demo-destroy.ps1:31 | SECRETS | Fixed & verified |
| critical | Database connection string with password A credential in source or pipeline definition is readable by every person and process with repository access, and by anyone who ever clones the history. Rotate it and load it from a secret store. | demo/snowflake-demo-destroy.ps1:33 | SECRETS | Fixed & verified |
| critical | Database connection string with password A credential in source or pipeline definition is readable by every person and process with repository access, and by anyone who ever clones the history. Rotate it and load it from a secret store. | dev-env/Build-AirlockAzureLab.ps1:143 | SECRETS | Fixed & verified |
| critical | Private key / certificate file committed Secret material must never live in the repository. Remove it from the index, add it to .gitignore, and rotate the key. | dist/titan-airlock-demo-classified-20260511-airlock/airlock-public-key.pem | SECRETS | Fixed & verified |
| critical | Private key / certificate file committed Secret material must never live in the repository. Remove it from the index, add it to .gitignore, and rotate the key. | dist/titan-airlock-demo-classified-20260512-airlock/airlock-public-key.pem | SECRETS | Fixed & verified |
| critical | Private key / certificate file committed Secret material must never live in the repository. Remove it from the index, add it to .gitignore, and rotate the key. | dist/titan-cloud-pro-bigco-ltd-20260504/airlock-public-key.pem | SECRETS | Fixed & verified |
| critical | Private key / certificate file committed Secret material must never live in the repository. Remove it from the index, add it to .gitignore, and rotate the key. | dist/titan-cloud-pro-demo-customer-20260505/airlock-public-key.pem | SECRETS | Fixed & verified |
| critical | Private key / certificate file committed Secret material must never live in the repository. Remove it from the index, add it to .gitignore, and rotate the key. | dist/titan-cloud-pro-demo-customer-20260511/airlock-public-key.pem | SECRETS | Fixed & verified |
| critical | Private key / certificate file committed Secret material must never live in the repository. Remove it from the index, add it to .gitignore, and rotate the key. | dist/titan-cloud-pro-demo-customer-20260512/airlock-public-key.pem | SECRETS | Fixed & verified |
| critical | US Social Security Number Identifiers hard-coded in application code indicate PHI handled outside a controlled data store. Review the data flow. | dist/titan-enterprise-apps-demo-customer-20260511/agents/oracle_portal_pack.py:1289 | PHI | Fixed & verified |
| critical | US Social Security Number Identifiers hard-coded in application code indicate PHI handled outside a controlled data store. Review the data flow. | dist/titan-enterprise-apps-demo-customer-20260511/agents/oracle_portal_pack.py:1304 | PHI | Fixed & verified |
| critical | US Social Security Number Identifiers hard-coded in application code indicate PHI handled outside a controlled data store. Review the data flow. | dist/titan-enterprise-apps-demo-customer-20260511/agents/oracle_portal_pack.py:1338 | PHI | Fixed & verified |
| critical | Private key / certificate file committed Secret material must never live in the repository. Remove it from the index, add it to .gitignore, and rotate the key. | dist/titan-enterprise-apps-demo-customer-20260511/airlock-public-key.pem | SECRETS | Fixed & verified |
| critical | US Social Security Number Identifiers hard-coded in application code indicate PHI handled outside a controlled data store. Review the data flow. | dist/titan-enterprise-apps-demo-customer-20260512/agents/oracle_portal_pack.py:1289 | PHI | Fixed & verified |
| critical | US Social Security Number Identifiers hard-coded in application code indicate PHI handled outside a controlled data store. Review the data flow. | dist/titan-enterprise-apps-demo-customer-20260512/agents/oracle_portal_pack.py:1304 | PHI | Fixed & verified |
| critical | US Social Security Number Identifiers hard-coded in application code indicate PHI handled outside a controlled data store. Review the data flow. | dist/titan-enterprise-apps-demo-customer-20260512/agents/oracle_portal_pack.py:1338 | PHI | Fixed & verified |
| critical | Private key / certificate file committed Secret material must never live in the repository. Remove it from the index, add it to .gitignore, and rotate the key. | dist/titan-enterprise-apps-demo-customer-20260512/airlock-public-key.pem | SECRETS | Fixed & verified |
| critical | Private key / certificate file committed Secret material must never live in the repository. Remove it from the index, add it to .gitignore, and rotate the key. | dist/titan-government-demo-agency-20260505/airlock-public-key.pem | SECRETS | Fixed & verified |
| critical | Private key / certificate file committed Secret material must never live in the repository. Remove it from the index, add it to .gitignore, and rotate the key. | dist/titan-government-demo-agency-20260511/airlock-public-key.pem | SECRETS | Fixed & verified |
| critical | Private key / certificate file committed Secret material must never live in the repository. Remove it from the index, add it to .gitignore, and rotate the key. | dist/titan-government-demo-agency-20260512/airlock-public-key.pem | SECRETS | Fixed & verified |
| critical | Private key / certificate file committed Secret material must never live in the repository. Remove it from the index, add it to .gitignore, and rotate the key. | dist/titan-government-dept-of-defense-20260504/airlock-public-key.pem | SECRETS | Fixed & verified |
| critical | US Social Security Number Identifiers hard-coded in application code indicate PHI handled outside a controlled data store. Review the data flow. | dist/titan-healthcare-demo-hospital-20260505/agents/oracle_portal_pack.py:1285 | PHI | Fixed & verified |
| critical | US Social Security Number Identifiers hard-coded in application code indicate PHI handled outside a controlled data store. Review the data flow. | dist/titan-healthcare-demo-hospital-20260505/agents/oracle_portal_pack.py:1300 | PHI | Fixed & verified |
| critical | US Social Security Number Identifiers hard-coded in application code indicate PHI handled outside a controlled data store. Review the data flow. | dist/titan-healthcare-demo-hospital-20260505/agents/oracle_portal_pack.py:1334 | PHI | Fixed & verified |
| critical | Private key / certificate file committed Secret material must never live in the repository. Remove it from the index, add it to .gitignore, and rotate the key. | dist/titan-healthcare-demo-hospital-20260505/airlock-public-key.pem | SECRETS | Fixed & verified |
| critical | Private key / certificate file committed Secret material must never live in the repository. Remove it from the index, add it to .gitignore, and rotate the key. | dist/titan-healthcare-demo-hospital-20260511/airlock-public-key.pem | SECRETS | Fixed & verified |
| critical | Private key / certificate file committed Secret material must never live in the repository. Remove it from the index, add it to .gitignore, and rotate the key. | dist/titan-healthcare-demo-hospital-20260512/airlock-public-key.pem | SECRETS | Fixed & verified |
| critical | US Social Security Number Identifiers hard-coded in application code indicate PHI handled outside a controlled data store. Review the data flow. | dist/titan-healthcare-st-mary-hospital-20260504/agents/oracle_portal_pack.py:1285 | PHI | Fixed & verified |
| critical | US Social Security Number Identifiers hard-coded in application code indicate PHI handled outside a controlled data store. Review the data flow. | dist/titan-healthcare-st-mary-hospital-20260504/agents/oracle_portal_pack.py:1300 | PHI | Fixed & verified |
| critical | US Social Security Number Identifiers hard-coded in application code indicate PHI handled outside a controlled data store. Review the data flow. | dist/titan-healthcare-st-mary-hospital-20260504/agents/oracle_portal_pack.py:1334 | PHI | Fixed & verified |
| critical | Private key / certificate file committed Secret material must never live in the repository. Remove it from the index, add it to .gitignore, and rotate the key. | dist/titan-healthcare-st-mary-hospital-20260504/airlock-public-key.pem | SECRETS | Fixed & verified |
| critical | Private key / certificate file committed Secret material must never live in the repository. Remove it from the index, add it to .gitignore, and rotate the key. | dist/titan-launch-acme-corp-20260504/airlock-public-key.pem | SECRETS | Fixed & verified |
| critical | Private key / certificate file committed Secret material must never live in the repository. Remove it from the index, add it to .gitignore, and rotate the key. | dist/titan-launch-demo-20260512-1638/airlock-public-key.pem | SECRETS | Fixed & verified |
| critical | Private key / certificate file committed Secret material must never live in the repository. Remove it from the index, add it to .gitignore, and rotate the key. | dist/titan-launch-demo-customer-20260505/airlock-public-key.pem | SECRETS | Fixed & verified |
| critical | Private key / certificate file committed Secret material must never live in the repository. Remove it from the index, add it to .gitignore, and rotate the key. | dist/titan-launch-demo-customer-20260511/airlock-public-key.pem | SECRETS | Fixed & verified |
| critical | Private key / certificate file committed Secret material must never live in the repository. Remove it from the index, add it to .gitignore, and rotate the key. | dist/titan-launch-demo-customer-20260512/airlock-public-key.pem | SECRETS | Fixed & verified |
| critical | US Social Security Number Identifiers hard-coded in application code indicate PHI handled outside a controlled data store. Review the data flow. | dist/titan-oracle-pro-acme-holdings-20260504/agents/oracle_portal_pack.py:1285 | PHI | Fixed & verified |
| critical | US Social Security Number Identifiers hard-coded in application code indicate PHI handled outside a controlled data store. Review the data flow. | dist/titan-oracle-pro-acme-holdings-20260504/agents/oracle_portal_pack.py:1300 | PHI | Fixed & verified |
| critical | US Social Security Number Identifiers hard-coded in application code indicate PHI handled outside a controlled data store. Review the data flow. | dist/titan-oracle-pro-acme-holdings-20260504/agents/oracle_portal_pack.py:1334 | PHI | Fixed & verified |
| critical | Database connection string with password A credential in source or pipeline definition is readable by every person and process with repository access, and by anyone who ever clones the history. Rotate it and load it from a secret store. | dist/titan-oracle-pro-acme-holdings-20260504/agents/snowflake_lattice.py:723 | SECRETS | Fixed & verified |
| critical | Private key / certificate file committed Secret material must never live in the repository. Remove it from the index, add it to .gitignore, and rotate the key. | dist/titan-oracle-pro-acme-holdings-20260504/airlock-public-key.pem | SECRETS | Fixed & verified |
| critical | US Social Security Number Identifiers hard-coded in application code indicate PHI handled outside a controlled data store. Review the data flow. | dist/titan-oracle-pro-demo-enterprise-20260505/agents/oracle_portal_pack.py:1285 | PHI | Fixed & verified |
| critical | US Social Security Number Identifiers hard-coded in application code indicate PHI handled outside a controlled data store. Review the data flow. | dist/titan-oracle-pro-demo-enterprise-20260505/agents/oracle_portal_pack.py:1300 | PHI | Fixed & verified |
| critical | US Social Security Number Identifiers hard-coded in application code indicate PHI handled outside a controlled data store. Review the data flow. | dist/titan-oracle-pro-demo-enterprise-20260505/agents/oracle_portal_pack.py:1334 | PHI | Fixed & verified |
| critical | Database connection string with password A credential in source or pipeline definition is readable by every person and process with repository access, and by anyone who ever clones the history. Rotate it and load it from a secret store. | dist/titan-oracle-pro-demo-enterprise-20260505/agents/snowflake_lattice.py:723 | SECRETS | Fixed & verified |
| critical | Private key / certificate file committed Secret material must never live in the repository. Remove it from the index, add it to .gitignore, and rotate the key. | dist/titan-oracle-pro-demo-enterprise-20260505/airlock-public-key.pem | SECRETS | Fixed & verified |
| critical | US Social Security Number Identifiers hard-coded in application code indicate PHI handled outside a controlled data store. Review the data flow. | dist/titan-oracle-pro-demo-enterprise-20260511/agents/oracle_portal_pack.py:1289 | PHI | Fixed & verified |
| critical | US Social Security Number Identifiers hard-coded in application code indicate PHI handled outside a controlled data store. Review the data flow. | dist/titan-oracle-pro-demo-enterprise-20260511/agents/oracle_portal_pack.py:1304 | PHI | Fixed & verified |
| critical | US Social Security Number Identifiers hard-coded in application code indicate PHI handled outside a controlled data store. Review the data flow. | dist/titan-oracle-pro-demo-enterprise-20260511/agents/oracle_portal_pack.py:1338 | PHI | Fixed & verified |
| critical | Private key / certificate file committed Secret material must never live in the repository. Remove it from the index, add it to .gitignore, and rotate the key. | dist/titan-oracle-pro-demo-enterprise-20260511/airlock-public-key.pem | SECRETS | Fixed & verified |
| critical | US Social Security Number Identifiers hard-coded in application code indicate PHI handled outside a controlled data store. Review the data flow. | dist/titan-oracle-pro-demo-enterprise-20260512/agents/oracle_portal_pack.py:1289 | PHI | Fixed & verified |
| critical | US Social Security Number Identifiers hard-coded in application code indicate PHI handled outside a controlled data store. Review the data flow. | dist/titan-oracle-pro-demo-enterprise-20260512/agents/oracle_portal_pack.py:1304 | PHI | Fixed & verified |
| critical | US Social Security Number Identifiers hard-coded in application code indicate PHI handled outside a controlled data store. Review the data flow. | dist/titan-oracle-pro-demo-enterprise-20260512/agents/oracle_portal_pack.py:1338 | PHI | Fixed & verified |
| critical | Private key / certificate file committed Secret material must never live in the repository. Remove it from the index, add it to .gitignore, and rotate the key. | dist/titan-oracle-pro-demo-enterprise-20260512/airlock-public-key.pem | SECRETS | Fixed & verified |
| critical | Private key / certificate file committed Secret material must never live in the repository. Remove it from the index, add it to .gitignore, and rotate the key. | dist/titan-telecom-demo-telecom-20260505/airlock-public-key.pem | SECRETS | Fixed & verified |
| critical | Private key / certificate file committed Secret material must never live in the repository. Remove it from the index, add it to .gitignore, and rotate the key. | dist/titan-telecom-demo-telecom-20260511/airlock-public-key.pem | SECRETS | Fixed & verified |
| critical | Private key / certificate file committed Secret material must never live in the repository. Remove it from the index, add it to .gitignore, and rotate the key. | dist/titan-telecom-demo-telecom-20260512/airlock-public-key.pem | SECRETS | Fixed & verified |
| critical | Private key / certificate file committed Secret material must never live in the repository. Remove it from the index, add it to .gitignore, and rotate the key. | dist/titan-telecom-verizon-telecom-20260504/airlock-public-key.pem | SECRETS | Fixed & verified |
| critical | Private key / certificate file committed Secret material must never live in the repository. Remove it from the index, add it to .gitignore, and rotate the key. | lab/keys/airlock-public-key.pem | SECRETS | Fixed & verified |
| critical | Private key / certificate file committed Secret material must never live in the repository. Remove it from the index, add it to .gitignore, and rotate the key. | lab/keys/titanai-license-private.pem | SECRETS | Fixed & verified |
| critical | US Social Security Number Identifiers hard-coded in application code indicate PHI handled outside a controlled data store. Review the data flow. | lab/launch-customer/bundle/agents/oracle_portal_pack.py:1285 | PHI | Fixed & verified |
| critical | US Social Security Number Identifiers hard-coded in application code indicate PHI handled outside a controlled data store. Review the data flow. | lab/launch-customer/bundle/agents/oracle_portal_pack.py:1300 | PHI | Fixed & verified |
| critical | US Social Security Number Identifiers hard-coded in application code indicate PHI handled outside a controlled data store. Review the data flow. | lab/launch-customer/bundle/agents/oracle_portal_pack.py:1334 | PHI | Fixed & verified |
| critical | Database connection string with password A credential in source or pipeline definition is readable by every person and process with repository access, and by anyone who ever clones the history. Rotate it and load it from a secret store. | lab/launch-customer/bundle/agents/snowflake_lattice.py:723 | SECRETS | Fixed & verified |
| critical | Private key / certificate file committed Secret material must never live in the repository. Remove it from the index, add it to .gitignore, and rotate the key. | lab/launch-customer/bundle/airlock-public-key.pem | SECRETS | Fixed & verified |
| critical | Database connection string with password A credential in source or pipeline definition is readable by every person and process with repository access, and by anyone who ever clones the history. Rotate it and load it from a secret store. | portal/worker.js:86 | SECRETS | Fixed & verified |
| critical | Database connection string with password A credential in source or pipeline definition is readable by every person and process with repository access, and by anyone who ever clones the history. Rotate it and load it from a secret store. | portal/worker.js:185 | SECRETS | Fixed & verified |
| critical | AWS access key ID A credential in source or pipeline definition is readable by every person and process with repository access, and by anyone who ever clones the history. Rotate it and load it from a secret store. | reports/TITAN-ORACLE-DEMO-2026-04-17-2244.html:91 | SECRETS | Fixed & verified |
| critical | AWS access key ID A credential in source or pipeline definition is readable by every person and process with repository access, and by anyone who ever clones the history. Rotate it and load it from a secret store. | reports/TITAN-ORACLE-DEMO-2026-04-17-2245.html:91 | SECRETS | Fixed & verified |
| critical | Storage allows anonymous / public blob access Public blob access exposes every container to the internet. | reports/fix-verified-results-2026-04-19.json:14 | PIPELINE | Fixed & verified |
| critical | Storage allows anonymous / public blob access Public blob access exposes every container to the internet. | reports/fix-verified-results-2026-04-19.json:17 | PIPELINE | Fixed & verified |
| critical | AWS access key ID A credential in source or pipeline definition is readable by every person and process with repository access, and by anyone who ever clones the history. Rotate it and load it from a secret store. | reports/fix-verified-results-2026-04-19.json:238 | SECRETS | Fixed & verified |
| critical | AWS access key ID A credential in source or pipeline definition is readable by every person and process with repository access, and by anyone who ever clones the history. Rotate it and load it from a secret store. | reports/fix-verified-results-2026-04-19.json:241 | SECRETS | Fixed & verified |
Secrets became references to a vault or a pipeline secret variable, committed key files were removed from the tree and ignored, actions were pinned, permissions were added, patient data in fixtures was redacted. Values are masked here.
| File | Issue | Before | After |
|---|---|---|---|
| Build-FullVulnAzure.ps1:19 | Payment card number (Luhn-valid) | "ssn************************UTF8 | "ssn,name,dob,cc`n123-45-6789,Jane Doe,1985-03-15,4111-1111-1111-1111`n987-65-4321,John Smith,1972-11-08,5500000000000004" | Out-File "$env:TEMP\titan-pii.csv" |
| Build-FullVulnAzure.ps1:19 | Payment card number (Luhn-valid) | "ssn************************UTF8 | "ssn,name,dob,cc`n123-45-6789,Jane Doe,1985-03-15,4111-1111-1111-1111`n987-65-4321,John Smith,1972-11-08,4111-1111-1111-1111" | Out-File "$env:TEMP\titan-pii.cs |
| Build-Phase3-Final.ps1:13 | Database connection string with password | $sql************************orce | $sqlPwd = $env:DB_PASSWORD 'P@ssw0rd!Weak123' -AsPlainText -Force |
| Build-Phase3-FullBugs.ps1:90 | AWS access key ID | "fak************************pifa | "fake aws_access_key_id=$env:AWS_ACCESS_KEY_ID`nfake aws_secret_access_key=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY`nfake azure_client_secret=Q7Z8V9W0X1Y2Z3A4B5 |
| Build-Phase3-FullBugs.ps1:90 | AWS secret access key | "fak************************dapi | "fake aws_access_key_id=$env:AWS_ACCESS_KEY_ID`nfake aws_secret_access_key=$env:AWS_SECRET_ACCESS_KEY`nfake azure_client_secret=Q7Z8V9W0X1Y2Z3A4B5C6D7E8F9G0H1I2 |
| Build-Phase3-FullBugs.ps1:90 | Azure AD / Entra client secret | "fak************************7890 | "fake aws_access_key_id=$env:AWS_ACCESS_KEY_ID`nfake aws_secret_access_key=$env:AWS_SECRET_ACCESS_KEY`nfake azure_client_secret=$env:AZURE_CLIENT_SECRET`nfake d |
| Build-Phase3-FullBugs.ps1:57 | Database connection string with password | $vmP************************orce | $vmPwd = $env:DB_PASSWORD 'P@ssw0rd!Weak123' -AsPlainText -Force |
| Build-Phase3-FullBugs.ps1:20 | Database connection string with password | $sql************************orce | $sqlPwd = $env:DB_PASSWORD 'P@ssw0rd!Weak123' -AsPlainText -Force |
| Build-Phase3-Retry.ps1:25 | Database connection string with password | $sql************************orce | $sqlPwd = $env:DB_PASSWORD 'P@ssw0rd!Weak123' -AsPlainText -Force |
| Test-AllTiers-LiveAzure.ps1:90 | Database connection string with password | $sql************************orce | $sqlPwd = $env:DB_PASSWORD 'P@ssw0rd!Weak123' -AsPlainText -Force |
| Test-AllTiers-LiveAzure.ps1:65 | US Social Security Number | "fak************************UTF8 | "fake credit card 4111-1111-1111-1111`nfake ssn 000-00-0000" | Out-File "$env:TEMP\titan-leak.txt" -Encoding UTF8 |
| _backups/v196-prod-ready-20260425/agents/oracle_portal_pack.py:1723 | High-entropy secret assigned to a credential variable | var ************************ns'; | var key = os.environ["KEY"]; |
| _backups/v196-prod-ready-20260425/agents/oracle_portal_pack.py:1152 | US Social Security Number | "bod************************12", | "body_preview": "SSN 000-00-0000 for John Doe DOB 08/14/1966 MRN-778812", |
| _backups/v196-prod-ready-20260425/agents/oracle_portal_pack.py:1137 | US Social Security Number | "htt************************89", | "https://portal.regional-health.example/auth?member_id=SUB-221199&ssn=000-00-0000", |
| _backups/v196-prod-ready-20260425/demo/azure-demo-create.ps1:141 | Database connection string with password | $sql************************orce | $sqlPwd = $env:DB_PASSWORD $AdminPassword -AsPlainText -Force |
| agents/_airgap_certify.py:129 | Database connection string with password | clea************************.5") | clean, hits = redact("password=" + os.environ["DB_PASSWORD"] + " ip 10.0.0.5") |
| agents/_guardrails.py:224 | Database connection string with password | got ************************ng") | got = guarded_call("test", lambda p: "Benign explanation of the finding.", "password=" + os.environ["DB_PASSWORD"] + " finding") |
| agents/_guardrails.py:194 | Database connection string with password | t, n************************.4") | t, n = redact("password=" + os.environ["DB_PASSWORD"] + " AccountKey=abcdefghijklmnopqrstuv== ip 10.0.0.4") |
| agents/healthcare_phi_audit.py:392 | US Social Security Number | "log************************"}], | "logs": [{"name": "app-diagnostics", "sample_text": "ERROR processing SSN 000-00-0000 for member_id ABC123456"}], |
| agents/healthcare_phi_audit.py:366 | US Social Security Number | all(************************ts)) | all("000-00-0000" not in h["masked"] for h in hits)) |
| agents/healthcare_phi_audit.py:361 | US Social Security Number | hits************************12") | hits = scan_text("Patient SSN 000-00-0000 seen on DOB: 1980-04-12") |
| agents/oracle_portal_pack.py:1928 | High-entropy secret assigned to a credential variable | var ************************ns'; | var key = os.environ["KEY"]; |
| agents/oracle_portal_pack.py:1338 | US Social Security Number | "pay************************99", | "payload_sample": "ssn=000-00-0000,dob=1974-04-17,member_id=SUB-221199", |
| agents/oracle_portal_pack.py:1304 | US Social Security Number | "bod************************12", | "body_preview": "SSN 000-00-0000 for John Doe DOB 08/14/1966 MRN-778812", |
| agents/oracle_portal_pack.py:1289 | US Social Security Number | "htt************************89", | "https://portal.regional-health.example/auth?member_id=SUB-221199&ssn=000-00-0000", |
| agents/pipefix_engine/connectors.py:400 | Database connection string with password | self************************ord" | self.user, _, self.password = os.environ["DB_PASSWORD"]":") # "user:app_password" |
.github/workflows/build-and-publish-bundles.yml
The second scan surfaced 2 items the first pass could not see until the fixes landed. They are queued for the next run and shown honestly here, not hidden.
Each with the exact command or setting to apply and why PIPEFIX would not guess at it. Explore the same run as a dashboard, with Found / Fixed / Remediation / Acceptance tabs under every issue: open the dashboard →
Read-only scan first, no credit card. Then a fix branch and a pull request you approve.