---
issue: 116
title: "Frontend/scanner/backend: CI pipeline images not pinned to digests — tag-hijack risk"
severity: medium
domain: CI/CD
labels: [security, ci-cd, supply-chain]
status: open
created: 2026-05-30
source: Full Codebase Audit 2026-05-30
---

# Frontend/scanner/backend: CI pipeline images not pinned to digests — tag-hijack risk

**Severity:** medium
**Domain:** CI/CD
**Labels:** security, ci-cd, supply-chain

## Description

CI step images across all three repos use floating version tags or `latest` (node, buildx plugin, curl, alpine). A tag can be replaced with a malicious image that exfiltrates secrets or produces a compromised build artifact.

NB-40 and NB-41 pinned the scanner `alpine:latest` and buildx plugin. The broader policy of pinning all CI images across all repos remains a decision.

## Options

1. Pin all CI images (node, buildx plugin, curl, alpine) to immutable digests — track updates via Renovate.
2. Pin to specific version tags only.
3. Use a vetted internal mirror with digests.

## Recommendation

Pin every CI step image to a digest across all pipelines; track updates via Renovate. Affects all CI files in frontend, backend, and scanner.

## Affected Files

- `frontend/.woodpecker/development.yml:8`
- `frontend/.woodpecker/production.yml`
- `backend/.woodpecker/development.yml`
- `scanner/.woodpecker/development.yml`
- (and all other pipeline files)

## References

- [Full Codebase Audit 2026-05-30](../09%20-%20Audits/Full%20Codebase%20Audit%20-%202026-05-30.md) — DEC-76