[abir-vim]

Automated fleet sync of the Vim AppSec Agent. Scans when review starts instead of after every push, skips high-volume deployment/publish bots, supports the centrally configured Sonnet 5 profile, and avoids retrying permanent Bedrock failures. The fail-closed high-severity gate and PR findings comments remain enabled. See scanner-org for the source template.

[github-actions]

Vim AppSec Agent

Passed — findings are below the gate (blocks at high or dependency BLOCK).

Critical	High	Medium	Low	Info	Dep BLOCK	Dep WARN
0	0	1	2	3	0	0

Findings

Medium (1)

New dependency-only policy skips all Bedrock SAST for a bot identity

• Where: .github/workflows/security.yml:80
• CWE: CWE-863
• Remediation: Keep the bypass only if the gitops 'trigger' PRs genuinely never contain reviewable content. Harden it by: (1) also asserting the PR author (github.event.pull_request.user.login) equals the bot, not just github.actor; (2) failing safe to full when the actor/author check or the git diff cannot be evaluated (already partly handled); and (3) emitting a visible signal (summary note already present) plus alerting/metrics whenever dependency-only is chosen, so a misuse of the bot identity is detectable. Confirm no build/runtime step ever reads dummy.txt.

Low (2)

Security gate returns success in dependency-only mode without any SAST phase

• Where: .github/workflows/security.yml:617
• CWE: CWE-863
• Remediation: Treat this together with the dependency-only policy guard. Ensure the branch-protection required check and any auto-merge rules account for the fact that a green gate can mean 'SAST intentionally skipped'. Consider recording the chosen policy in scanner-stats so skipped scans are auditable.

10-minute debounce sleep on synchronize delays scanning of pushed commits

• Where: .github/workflows/security.yml:42
• CWE: CWE-693
• Remediation: Keep the Security gate as a required status check so a pending/debounced run blocks merge, and ensure auto-merge waits for it. If the debounce is purely a Bedrock cost measure, consider debouncing only the expensive ai-scan job rather than delaying the whole pipeline, so OSV and the gate still run promptly.

Info (3)

New 'labeled' trigger gates re-scan on the 'appsec-rescan' label

• Where: .github/workflows/security.yml:13
• CWE: CWE-693
• Remediation: No change required. Optionally document who may apply 'appsec-rescan' and ensure the label cannot be self-applied by untrusted automation.

claude-code-action pin bumped from v1.0.174 to v1.0.245 (still SHA-pinned)

• Where: .github/workflows/security.yml:231
• CWE: CWE-1104
• Remediation: Confirm the new SHA 6fed3ca145920b639991cb756090506e1bcaf515 corresponds to the reviewed v1.0.245 tag before merge. No further action needed; keep SHA pinning.

GitHub context values flow into shell only through quoted env vars (no injection)

• Where: .github/workflows/security.yml:82
• CWE: CWE-78
• Remediation: No change required. Continue passing all github.* context values through env vars rather than inlining them into run scripts.

---

Gate blocks at severity high or a dependency marked BLOCK.

Questions, false positives, or feedback — ping @abir-vim.