devsecops

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The GitHub Actions workflow pulls and executes external actions at runtime—actions/checkout@v4, trufflesecurity/trufflehog@main, and returntocorp/semgrep-action@v1—which fetch and run remote code on the runner.