Remaining infosec findings from 27626
@margaretjgu is already working on this.
Since Aug 21, 2026.
Assessment
This issue has not been assessed yet.
Description
Follow-up to the review in https://github.com/elastic/infosec/issues/27626.
Closed findings stay there. These four are still open, all medium:
- https://github.com/elastic/cli/issues/509 ECLI-003: Buildkite bootstraps executable tools without repository-controlled integrity verification
- https://github.com/elastic/cli/issues/512 ECLI-006: All extensions receive every configured Elastic credential
- https://github.com/elastic/cli/issues/518 ECLI-012: Privileged workflows execute branch-controlled npm lifecycle code
- https://github.com/elastic/cli/issues/520 ECLI-014: Buildkite PR builds may execute branch-controlled code on a Vault-capable agent
- Dominant language
- TypeScript
- Stars
- 43
- Forks
- 24
- Avg merge
- 1d 7h
- Merged PRs (30d)
- 62
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from elastic/cli
-
cloud enhancement
Difficulty 1/5 1-3 hours Newbie friendliness 88/100
-
enhancement
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
-
enhancement
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
-
bug v2
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
modelcontextprotocol/inspector#2458 · 1 comment ·
-
Difficulty 1/5 Under an hour Newbie friendliness 75/100
railmapgen/rmp-gallery#4068 ·
-
Mend: dependency security vulnerability status: needs triage 🕵️♀️
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
carbon-design-system/ibm-products#9907 ·