Workflow Permissions: 1 issue found

[hekkos-app]

Hekkos found 1 Workflow Permissions configuration issue in this repository.

_{This is part of the main security audit.}

Issue details

• Issue 1: 3 workflow file(s) missing top-level 'permissions' block (follows principle of least privilege): branch.yml, cd.yml, tag.yml

---

Why this matters

Restrictive workflow permissions limit what automated workflows can do. This reduces:

• The potential impact if a workflow is compromised or has a bug
• The ability for workflows to make unintended repository changes
• The risk of credential exposure through overly permissive tokens
• The attack surface available to malicious pull requests

---

How to fix

1. Navigate to Settings > Actions > General
2. Under Workflow permissions, select Read repository contents permission
3. Uncheck Allow GitHub Actions to create and approve pull requests unless required
4. Grant write permissions only to specific workflows using permissions: in workflow files

Documentation:

• Automatic token authentication
• Setting workflow permissions