[CI/CD Security] fluttercandies/flutter_image_editor - Issue Report

[github-actions]

📦 fluttercandies/flutter_image_editor

📌 Commit SHA: b04e083cc7e6d07abc2a639b9eca696bcb4195b4

🕜 Report generated at: 2026-09-02T06:40:42.996Z

🔍 Overview

Severity	Count
🔴 High	40

📁 Details

📄 .github/workflows/melos-version.yml - 🔴High(3)

1	Severity	Audit Rule	Confidence
	🔴 High	excessive-permissions	High
Audit: overly broad permissions: contents: write is overly broad at the workflow level Remediation: view audit

• .github/workflows/melos-version.yml#L7
  Audit: contents: write is overly broad at the workflow level

    contents: write

---

2	Severity	Audit Rule	Confidence
	🔴 High	unpinned-uses	High
Audit: unpinned action reference: action is not pinned to a hash (required by blanket policy) Remediation: view audit

• .github/workflows/melos-version.yml#L16
  Audit: action is not pinned to a hash (required by blanket policy)

  actions/checkout@v4

---

3	Severity	Audit Rule	Confidence
	🔴 High	unpinned-uses	High
Audit: unpinned action reference: action is not pinned to a hash (required by blanket policy) Remediation: view audit

• .github/workflows/melos-version.yml#L18
  Audit: action is not pinned to a hash (required by blanket policy)

  subosito/flutter-action@v2

---

📄 .github/workflows/publish_on_tag.yml - 🔴High(2)

1	Severity	Audit Rule	Confidence
	🔴 High	unpinned-uses	High
Audit: unpinned action reference: action is not pinned to a hash (required by blanket policy) Remediation: view audit

• .github/workflows/publish_on_tag.yml#L16
  Audit: action is not pinned to a hash (required by blanket policy)

  actions/checkout@v4

---

2	Severity	Audit Rule	Confidence
	🔴 High	unpinned-uses	High
Audit: unpinned action reference: action is not pinned to a hash (required by blanket policy) Remediation: view audit

• .github/workflows/publish_on_tag.yml#L18
  Audit: action is not pinned to a hash (required by blanket policy)

  subosito/flutter-action@v2

---

📄 .github/workflows/runnable.yml - 🔴High(9)

1	Severity	Audit Rule	Confidence
	🔴 High	unpinned-uses	High
Audit: unpinned action reference: action is not pinned to a hash (required by blanket policy) Remediation: view audit

• .github/workflows/runnable.yml#L11
  Audit: action is not pinned to a hash (required by blanket policy)

  actions/checkout@v4

---

2	Severity	Audit Rule	Confidence
	🔴 High	unpinned-uses	High
Audit: unpinned action reference: action is not pinned to a hash (required by blanket policy) Remediation: view audit

• .github/workflows/runnable.yml#L12
  Audit: action is not pinned to a hash (required by blanket policy)

  subosito/flutter-action@v2

---

3	Severity	Audit Rule	Confidence
	🔴 High	unpinned-uses	High
Audit: unpinned action reference: action is not pinned to a hash (required by blanket policy) Remediation: view audit

• .github/workflows/runnable.yml#L28
  Audit: action is not pinned to a hash (required by blanket policy)

  actions/checkout@v4

---

4	Severity	Audit Rule	Confidence
	🔴 High	unpinned-uses	High
Audit: unpinned action reference: action is not pinned to a hash (required by blanket policy) Remediation: view audit

• .github/workflows/runnable.yml#L29
  Audit: action is not pinned to a hash (required by blanket policy)

  subosito/flutter-action@v2

---

5	Severity	Audit Rule	Confidence
	🔴 High	unpinned-uses	High
Audit: unpinned action reference: action is not pinned to a hash (required by blanket policy) Remediation: view audit

• .github/workflows/runnable.yml#L43
  Audit: action is not pinned to a hash (required by blanket policy)

  actions/checkout@v4

---

6	Severity	Audit Rule	Confidence
	🔴 High	unpinned-uses	High
Audit: unpinned action reference: action is not pinned to a hash (required by blanket policy) Remediation: view audit

• .github/workflows/runnable.yml#L44
  Audit: action is not pinned to a hash (required by blanket policy)

  actions/setup-java@v4

---

7	Severity	Audit Rule	Confidence
	🔴 High	unpinned-uses	High
Audit: unpinned action reference: action is not pinned to a hash (required by blanket policy) Remediation: view audit

• .github/workflows/runnable.yml#L48
  Audit: action is not pinned to a hash (required by blanket policy)

  subosito/flutter-action@v2

---

8	Severity	Audit Rule	Confidence
	🔴 High	unpinned-uses	High
Audit: unpinned action reference: action is not pinned to a hash (required by blanket policy) Remediation: view audit

• .github/workflows/runnable.yml#L65
  Audit: action is not pinned to a hash (required by blanket policy)

  actions/checkout@v4

---

9	Severity	Audit Rule	Confidence
	🔴 High	unpinned-uses	High
Audit: unpinned action reference: action is not pinned to a hash (required by blanket policy) Remediation: view audit

• .github/workflows/runnable.yml#L66
  Audit: action is not pinned to a hash (required by blanket policy)

  subosito/flutter-action@v2

---

📄 .github/workflows/try-add-to-new-project.yml - 🔴High(26)

1	Severity	Audit Rule	Confidence
	🔴 High	unpinned-uses	High
Audit: unpinned action reference: action is not pinned to a hash (required by blanket policy) Remediation: view audit

• .github/workflows/try-add-to-new-project.yml#L9
  Audit: action is not pinned to a hash (required by blanket policy)

  actions/checkout@v4

---

2	Severity	Audit Rule	Confidence
	🔴 High	unpinned-uses	High
Audit: unpinned action reference: action is not pinned to a hash (required by blanket policy) Remediation: view audit

• .github/workflows/try-add-to-new-project.yml#L10
  Audit: action is not pinned to a hash (required by blanket policy)

  subosito/flutter-action@v2

---

3	Severity	Audit Rule	Confidence
	🔴 High	unpinned-uses	High
Audit: unpinned action reference: action is not pinned to a hash (required by blanket policy) Remediation: view audit

• .github/workflows/try-add-to-new-project.yml#L15
  Audit: action is not pinned to a hash (required by blanket policy)

  actions/setup-java@v3

---

4	Severity	Audit Rule	Confidence
	🔴 High	unpinned-uses	High
Audit: unpinned action reference: action is not pinned to a hash (required by blanket policy) Remediation: view audit

• .github/workflows/try-add-to-new-project.yml#L36
  Audit: action is not pinned to a hash (required by blanket policy)

  actions/checkout@v4

---

5	Severity	Audit Rule	Confidence
	🔴 High	unpinned-uses	High
Audit: unpinned action reference: action is not pinned to a hash (required by blanket policy) Remediation: view audit

• .github/workflows/try-add-to-new-project.yml#L37
  Audit: action is not pinned to a hash (required by blanket policy)

  subosito/flutter-action@v2

---

6	Severity	Audit Rule	Confidence
	🔴 High	unpinned-uses	High
Audit: unpinned action reference: action is not pinned to a hash (required by blanket policy) Remediation: view audit

• .github/workflows/try-add-to-new-project.yml#L42
  Audit: action is not pinned to a hash (required by blanket policy)

  actions/setup-java@v3

---

7	Severity	Audit Rule	Confidence
	🔴 High	unpinned-uses	High
Audit: unpinned action reference: action is not pinned to a hash (required by blanket policy) Remediation: view audit

• .github/workflows/try-add-to-new-project.yml#L63
  Audit: action is not pinned to a hash (required by blanket policy)

  actions/checkout@v4

---

8	Severity	Audit Rule	Confidence
	🔴 High	unpinned-uses	High
Audit: unpinned action reference: action is not pinned to a hash (required by blanket policy) Remediation: view audit

• .github/workflows/try-add-to-new-project.yml#L64
  Audit: action is not pinned to a hash (required by blanket policy)

  subosito/flutter-action@v2

---

9	Severity	Audit Rule	Confidence
	🔴 High	unpinned-uses	High
Audit: unpinned action reference: action is not pinned to a hash (required by blanket policy) Remediation: view audit

• .github/workflows/try-add-to-new-project.yml#L69
  Audit: action is not pinned to a hash (required by blanket policy)

  actions/setup-java@v3

---

10	Severity	Audit Rule	Confidence
	🔴 High	unpinned-uses	High
Audit: unpinned action reference: action is not pinned to a hash (required by blanket policy) Remediation: view audit

• .github/workflows/try-add-to-new-project.yml#L90
  Audit: action is not pinned to a hash (required by blanket policy)

  actions/checkout@v4

---

11	Severity	Audit Rule	Confidence
	🔴 High	unpinned-uses	High
Audit: unpinned action reference: action is not pinned to a hash (required by blanket policy) Remediation: view audit

• .github/workflows/try-add-to-new-project.yml#L91
  Audit: action is not pinned to a hash (required by blanket policy)

  subosito/flutter-action@v2

---

12	Severity	Audit Rule	Confidence
	🔴 High	unpinned-uses	High
Audit: unpinned action reference: action is not pinned to a hash (required by blanket policy) Remediation: view audit

• .github/workflows/try-add-to-new-project.yml#L118
  Audit: action is not pinned to a hash (required by blanket policy)

  actions/checkout@v4

---

13	Severity	Audit Rule	Confidence
	🔴 High	unpinned-uses	High
Audit: unpinned action reference: action is not pinned to a hash (required by blanket policy) Remediation: view audit

• .github/workflows/try-add-to-new-project.yml#L119
  Audit: action is not pinned to a hash (required by blanket policy)

  subosito/flutter-action@v2

---

14	Severity	Audit Rule	Confidence
	🔴 High	unpinned-uses	High
Audit: unpinned action reference: action is not pinned to a hash (required by blanket policy) Remediation: view audit

• .github/workflows/try-add-to-new-project.yml#L146
  Audit: action is not pinned to a hash (required by blanket policy)

  actions/checkout@v4

---

15	Severity	Audit Rule	Confidence
	🔴 High	unpinned-uses	High
Audit: unpinned action reference: action is not pinned to a hash (required by blanket policy) Remediation: view audit

• .github/workflows/try-add-to-new-project.yml#L147
  Audit: action is not pinned to a hash (required by blanket policy)

  subosito/flutter-action@v2

---

16	Severity	Audit Rule	Confidence
	🔴 High	unpinned-uses	High
Audit: unpinned action reference: action is not pinned to a hash (required by blanket policy) Remediation: view audit

• .github/workflows/try-add-to-new-project.yml#L174
  Audit: action is not pinned to a hash (required by blanket policy)

  actions/checkout@v4

---

17	Severity	Audit Rule	Confidence
	🔴 High	unpinned-uses	High
Audit: unpinned action reference: action is not pinned to a hash (required by blanket policy) Remediation: view audit

• .github/workflows/try-add-to-new-project.yml#L175
  Audit: action is not pinned to a hash (required by blanket policy)

  subosito/flutter-action@v2

---

18	Severity	Audit Rule	Confidence
	🔴 High	unpinned-uses	High
Audit: unpinned action reference: action is not pinned to a hash (required by blanket policy) Remediation: view audit

• .github/workflows/try-add-to-new-project.yml#L197
  Audit: action is not pinned to a hash (required by blanket policy)

  actions/checkout@v4

---

19	Severity	Audit Rule	Confidence
	🔴 High	unpinned-uses	High
Audit: unpinned action reference: action is not pinned to a hash (required by blanket policy) Remediation: view audit

• .github/workflows/try-add-to-new-project.yml#L198
  Audit: action is not pinned to a hash (required by blanket policy)

  subosito/flutter-action@v2

---

20	Severity	Audit Rule	Confidence
	🔴 High	unpinned-uses	High
Audit: unpinned action reference: action is not pinned to a hash (required by blanket policy) Remediation: view audit

• .github/workflows/try-add-to-new-project.yml#L220
  Audit: action is not pinned to a hash (required by blanket policy)

  actions/checkout@v4

---

21	Severity	Audit Rule	Confidence
	🔴 High	unpinned-uses	High
Audit: unpinned action reference: action is not pinned to a hash (required by blanket policy) Remediation: view audit

• .github/workflows/try-add-to-new-project.yml#L221
  Audit: action is not pinned to a hash (required by blanket policy)

  subosito/flutter-action@v2

---

22	Severity	Audit Rule	Confidence
	🔴 High	unpinned-uses	High
Audit: unpinned action reference: action is not pinned to a hash (required by blanket policy) Remediation: view audit

• .github/workflows/try-add-to-new-project.yml#L243
  Audit: action is not pinned to a hash (required by blanket policy)

  actions/checkout@v4

---

23	Severity	Audit Rule	Confidence
	🔴 High	unpinned-uses	High
Audit: unpinned action reference: action is not pinned to a hash (required by blanket policy) Remediation: view audit

• .github/workflows/try-add-to-new-project.yml#L244
  Audit: action is not pinned to a hash (required by blanket policy)

  subosito/flutter-action@v2

---

24	Severity	Audit Rule	Confidence
	🔴 High	unpinned-uses	High
Audit: unpinned action reference: action is not pinned to a hash (required by blanket policy) Remediation: view audit

• .github/workflows/try-add-to-new-project.yml#L272
  Audit: action is not pinned to a hash (required by blanket policy)

  actions/checkout@v4

---

25	Severity	Audit Rule	Confidence
	🔴 High	unpinned-uses	High
Audit: unpinned action reference: action is not pinned to a hash (required by blanket policy) Remediation: view audit

• .github/workflows/try-add-to-new-project.yml#L273
  Audit: action is not pinned to a hash (required by blanket policy)

  subosito/flutter-action@v2

---

26	Severity	Audit Rule	Confidence
	🔴 High	unpinned-uses	High
Audit: unpinned action reference: action is not pinned to a hash (required by blanket policy) Remediation: view audit

• .github/workflows/try-add-to-new-project.yml#L301
  Audit: action is not pinned to a hash (required by blanket policy)

  actions/checkout@v4

---