The threat
A workflow that interpolates untrusted input into a run step, pins a mutable action ref, grants broad permissions, or exposes a secret in a run is a direct path to a compromised build — the way many recent supply-chain attacks actually land.
How Stateward catches it
Stateward’s CI/CD engine inspects GitHub Actions and GitLab CI for script injection, mutable refs, over-broad permissions and secret-in-run, on every change to your pipeline files.
Recent advisories of this class
- mediumGHSA-HHPQ-7WG4-36JMCakePHP Authentication: Open redirect weakness via backslash bypass
- criticalGHSA-8FQ9-273G-6MRGAvo: Missing Authorization in Avo Association Attach Endpoint Allows Unauthorized Relationship Manipulation and Privilege Escalation
- mediumGHSA-X2QC-CMH9-F4HFDeno: Denial of service via non-ASCII bytes in WebSocket response headers
- criticalGHSA-2F55-G35J-5JMFHAPI FHIR: XXE in XsltUtilities.saxonTransform via unhardened Saxon TransformerFactory
Check your own repo for this
Connect a repo and Stateward reviews your next pull request — read-only, free for individuals and open source.
Built to be trusted with your code
Read-only & ephemeral
Stateward can comment, but never pushes, merges or stores your keys.
EU-sovereign hosting
Code and security data stay EU-hosted via Citadea — built for NIS2, DORA and the CRA.
Whole-codebase aware
Reasons over your call graph and trust boundaries, not just the diff.
Stateward is in beta and onboarding design partners. Built by Yggdrasil Digital.