auditing-config-and-build-hygiene

The scan indicates multiple concrete CI/build/config hygiene defects: secret baked into Docker image layers (Stripe key), mutable/unpinned CI action and base image (:latest), non-reproducible dependency installation (no lock), soft-failed test gate (continue-on-error), unsafe env-specific runtime branching and DEBUG default True with lazy config loading, machine-local build toolchain path dependency, and a critical remote-code-execution build step (wget … | sh without pin/checksum). Feature flags include stale/dead flags and ownerless live flags. While explicit malware behaviors are not directly proven from this text alone, the presence of wget|sh and broad supply-chain variability makes this supply chain materially unsafe. Recommend immediate remediation: remove baked secrets, pin actions/images/deps, make test gates blocking, eliminate wget|sh or verify integrity, and fix config validation and flag ownership.