Skip to content

Security Scan

Security Scan #280

Triggered via schedule June 21, 2026 08:04
Status Failure
Total duration 3m 17s
Artifacts 5

security-scan.yml

on: schedule
cargo audit
3m 13s
cargo audit
Secret scan (gitleaks)
4s
Secret scan (gitleaks)
IaC scan (checkov)
32s
IaC scan (checkov)
Matrix: CodeQL SAST
Matrix: npm audit
Matrix: Trivy container scan
Fit to window
Zoom out
Zoom in

Annotations

24 errors and 15 warnings
Secret scan (gitleaks)
🛑 missing gitleaks license. Go grab one at gitleaks.io and store it as a GitHub Secret named GITLEAKS_LICENSE. For more info about the recent breaking update, see [here](https://github.com/gitleaks/gitleaks-action#-announcement).
npm audit (api)
Process completed with exit code 1.
npm audit (components)
The strategy configuration was canceled because "npm-audit.api" failed
npm audit (components)
Process completed with exit code 1.
Trivy container scan (api, api/Dockerfile, stellar-escrow-api)
Path does not exist: trivy-stellar-escrow-api.sarif
Trivy container scan (api, api/Dockerfile, stellar-escrow-api)
Process completed with exit code 1.
npm audit (app)
The strategy configuration was canceled because "npm-audit.api" failed
npm audit (app)
The operation was canceled.
npm audit (client)
The strategy configuration was canceled because "npm-audit.api" failed
npm audit (client)
Process completed with exit code 1.
Trivy container scan (client, client/Dockerfile, stellar-escrow-client)
The strategy configuration was canceled because "trivy-scan.api_api_Dockerfile_stella" failed
Trivy container scan (client, client/Dockerfile, stellar-escrow-client)
Path does not exist: trivy-stellar-escrow-client.sarif
Trivy container scan (client, client/Dockerfile, stellar-escrow-client)
Process completed with exit code 1.
IaC scan (checkov)
CKV_AWS_354: "Ensure RDS Performance Insights are encrypted using KMS CMKs"
IaC scan (checkov)
CKV_AWS_129: "Ensure that respective logs of Amazon Relational Database Service (Amazon RDS) are enabled"
IaC scan (checkov)
CKV_AWS_354: "Ensure RDS Performance Insights are encrypted using KMS CMKs"
IaC scan (checkov)
CKV_AWS_23: "Ensure every security group and rule has a description"
IaC scan (checkov)
CKV_AWS_382: "Ensure no security groups allow egress from 0.0.0.0:0 to port -1"
IaC scan (checkov)
CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
IaC scan (checkov)
CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
IaC scan (checkov)
CKV_AWS_51: "Ensure ECR Image Tags are immutable"
IaC scan (checkov)
CKV_AWS_149: "Ensure that Secrets Manager secret is encrypted using KMS CMK"
IaC scan (checkov)
CKV_AWS_149: "Ensure that Secrets Manager secret is encrypted using KMS CMK"
cargo audit
Process completed with exit code 1.
Secret scan (gitleaks)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, gitleaks/gitleaks-action@v2. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
npm audit (api)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, actions/setup-node@v4, actions/upload-artifact@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
npm audit (components)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, actions/setup-node@v4, actions/upload-artifact@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
Trivy container scan (api, api/Dockerfile, stellar-escrow-api)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, github/codeql-action/upload-sarif@v3. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
Trivy container scan (api, api/Dockerfile, stellar-escrow-api)
CodeQL Action v3 will be deprecated in December 2026. Please update all occurrences of the CodeQL Action in your workflow files to v4. For more information, see https://github.blog/changelog/2025-10-28-upcoming-deprecation-of-codeql-action-v3/
npm audit (app)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, actions/setup-node@v4, actions/upload-artifact@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
npm audit (client)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, actions/setup-node@v4, actions/upload-artifact@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
Trivy container scan (client, client/Dockerfile, stellar-escrow-client)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, github/codeql-action/upload-sarif@v3. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
Trivy container scan (client, client/Dockerfile, stellar-escrow-client)
CodeQL Action v3 will be deprecated in December 2026. Please update all occurrences of the CodeQL Action in your workflow files to v4. For more information, see https://github.blog/changelog/2025-10-28-upcoming-deprecation-of-codeql-action-v3/
IaC scan (checkov)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, github/codeql-action/upload-sarif@v3. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
IaC scan (checkov)
CodeQL Action v3 will be deprecated in December 2026. Please update all occurrences of the CodeQL Action in your workflow files to v4. For more information, see https://github.blog/changelog/2025-10-28-upcoming-deprecation-of-codeql-action-v3/
CodeQL SAST (javascript-typescript)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, github/codeql-action/analyze@v3, github/codeql-action/autobuild@v3, github/codeql-action/init@v3. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
CodeQL SAST (javascript-typescript)
Failed to save: Unable to reserve cache with key codeql-trap-1-2.25.6-javascript-39a8413f190445d76ed05e1188f552144e17e42a, another job may be creating this cache.
CodeQL SAST (javascript-typescript)
CodeQL Action v3 will be deprecated in December 2026. Please update all occurrences of the CodeQL Action in your workflow files to v4. For more information, see https://github.blog/changelog/2025-10-28-upcoming-deprecation-of-codeql-action-v3/
cargo audit
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, actions/upload-artifact@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

Artifacts

Produced during runtime
Name Size Digest
cargo-audit-report Expired
3.99 KB
sha256:a324e16cfbdab25b4142a1216f2e6dd7ce27c2f4e953846e2eaeeac12fb1b2a8
npm-audit-api Expired
322 Bytes
sha256:af0bac6a4cf20cedd0c6c39163a55b446a27c8d4d494d2574147d8c3b3cfc68d
npm-audit-app Expired
322 Bytes
sha256:26880377c9d1accd67c88e7a8e79361d27c021a3afa67a959bd40bb1cfef740f
npm-audit-client Expired
328 Bytes
sha256:a9c5e089d6cf3ea413c9dad9e8894647c630452b973a7817e1153baae22816cc
npm-audit-components Expired
336 Bytes
sha256:1dfbd01277156a353c2fc5837fa5e770dbb59e2a1a73c51fceed201a8da0cf2a