T08 · Insecure Dependencies
Warning
- Location
SKILL.md:76- Finding
Unpinned External Executable Dependencies and Mutable Container Artifacts
- Content
View full analysis
- Remediation
View remediation
docker run ... xuxuclassmate/custom-mail@sha256: ``` 2. Remove the recommendation to use `latest`, and document the expected digest for each release. 3. Require container signature and provenance verification using an appropriate mechanism such as Cosign before execution. 4. Clone or fetch the repository and check out a reviewed immutable commit: ```bash git clone https://github.com/InnoNestX/Custom-Mail.git cd Custom-Mail git checkout ``` 5. Verify the commit signature or compare the commit hash against a trusted, separately published release manifest. 6. Commit and review dependency lockfiles. Replace `npm install` with `npm ci` so dependency resolution follows the lockfile exactly. 7. Pin Wrangler to a reviewed version rather than allowing implicit package resolution, and invoke it from a lockfile-controlled project dependency. 8. Review Dockerfiles, Compose files, package lifecycle scripts, Rust build scripts, and deployment scripts before executing them. 9. Use narrowly scoped, short-lived mail-provider and Cloudflare tokens. Avoid supplying production secrets until artifact integrity has been verified. 10. Run builds and dependency installation in an isolated environment without unrelated credentials, sensitive host mounts, or unnecessary network access. ]]>