Enum FindingCategory 

pub enum FindingCategory {
    AuthorityPropagation,
    OverPrivilegedIdentity,
    UnpinnedAction,
    UntrustedWithAuthority,
    ArtifactBoundaryCrossing,
    FloatingImage,
    LongLivedCredential,
    PersistedCredential,
    TriggerContextMismatch,
    CrossWorkflowAuthorityChain,
    AuthorityCycle,
    UpliftWithoutAttestation,
    SelfMutatingPipeline,
    CheckoutSelfPrExposure,
    VariableGroupInPrJob,
    SelfHostedPoolPrHijack,
    ServiceConnectionScopeMismatch,
    TemplateExtendsUnpinnedBranch,
    VmRemoteExecViaPipelineSecret,
    ShortLivedSasInCommandLine,
    SecretToInlineScriptEnvExport,
    SecretMaterialisedToWorkspaceFile,
    KeyVaultSecretToPlaintext,
    TerraformAutoApproveInProd,
    AddSpnWithInlineScript,
    ParameterInterpolationIntoShell,
    // some variants omitted
}

MVP categories (1-5) are derivable from pipeline YAML alone. Stretch categories (6-9) need heuristics or metadata enrichment.

Variants

AuthorityPropagation

OverPrivilegedIdentity

UnpinnedAction

UntrustedWithAuthority

ArtifactBoundaryCrossing

FloatingImage

LongLivedCredential

PersistedCredential

Credential written to disk by a step (e.g. persistCredentials: true on a checkout). Disk-persisted credentials are accessible to all subsequent steps and any process with filesystem access, unlike runtime-only HasAccessTo authority.

TriggerContextMismatch

Dangerous trigger type (pull_request_target / pr) combined with secret/identity access.

CrossWorkflowAuthorityChain

Authority (secret/identity) flows into an opaque external workflow via DelegatesTo.

AuthorityCycle

Circular DelegatesTo chain — workflow calls itself transitively.

UpliftWithoutAttestation

Privileged workflow (OIDC/broad identity) with no provenance attestation step.

SelfMutatingPipeline

Step writes to the environment gate ($GITHUB_ENV, pipeline variables) — authority can propagate.

CheckoutSelfPrExposure

PR-triggered pipeline checks out the repository — attacker-controlled fork code lands on the runner.

VariableGroupInPrJob

ADO variable group consumed by a PR-triggered job, crossing trust boundary.

SelfHostedPoolPrHijack

Self-hosted agent pool used in a PR-triggered job that also checks out the repository.

ServiceConnectionScopeMismatch

Broad-scope ADO service connection reachable from a PR-triggered job without OIDC.

TemplateExtendsUnpinnedBranch

ADO resources.repositories[] entry referenced by an extends:, template: x@alias, or checkout: alias consumer resolves with no ref: (default branch) or a mutable branch ref (refs/heads/<name>). Whoever owns that branch can inject steps into the consuming pipeline.

VmRemoteExecViaPipelineSecret

Pipeline step uses an Azure VM remote-exec primitive (Set-AzVMExtension / CustomScriptExtension, Invoke-AzVMRunCommand, az vm run-command, az vm extension set) where the executed command line interpolates a pipeline secret or a SAS token — pipeline-to-VM lateral movement primitive logged in plaintext to the VM and ARM.

ShortLivedSasInCommandLine

A SAS token freshly minted in-pipeline is interpolated into a CLI argument (commandToExecute / scriptArguments / –arguments / -ArgumentList) instead of passed via env var or stdin — argv ends up in /proc/*/cmdline, ETW, ARM status.

SecretToInlineScriptEnvExport

Pipeline secret value assigned to a shell variable inside an inline script (export VAR=$(SECRET), $X = "$(SECRET)"). Once the value transits a shell variable, ADO’s $(SECRET) log mask no longer applies — transcripts (Start-Transcript, bash -x, terraform debug logs) print the cleartext.

SecretMaterialisedToWorkspaceFile

Pipeline secret value written to a file under the agent workspace ($(System.DefaultWorkingDirectory), $(Build.SourcesDirectory), or relative paths) without secureFile task or chmod 600. The file persists in the agent workspace and is uploaded by PublishPipelineArtifact and crawlable by later steps.

KeyVaultSecretToPlaintext

PowerShell pulls a Key Vault secret with -AsPlainText (or ConvertFrom-SecureString -AsPlainText, or older .SecretValueText syntax) into a non-SecureString variable. The value never traverses the ADO variable-group boundary, so verbose Az/PS logging and error stack traces print the credential.

Rule id is keyvault_secret_to_plaintext (single token “keyvault”) rather than the snake_case derivation key_vault_… — matches the docs filename and the convention used in the corpus evidence.

TerraformAutoApproveInProd

terraform apply -auto-approve against a production-named service connection without an environment approval gate.

AddSpnWithInlineScript

AzureCLI@2 task with addSpnToEnvironment: true AND an inline script — the script can launder federated SPN/OIDC tokens into pipeline variables.

ParameterInterpolationIntoShell

A type: string pipeline parameter (no values: allowlist) is interpolated via ${{ parameters.X }} into an inline shell/PowerShell script body — shell injection vector for anyone with “queue build”.

Trait Implementations

impl Clone for FindingCategory

fn clone(&self) -> FindingCategory

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for FindingCategory

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for FindingCategory

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Hash for FindingCategory

fn hash<__H: Hasher>(&self, state: &mut __H)

Feeds this value into the given Hasher.

fn hash_slice<H>(data: &[Self], state: &mut H)

where H: Hasher, Self: Sized,

Feeds a slice of this type into the given Hasher.

impl PartialEq for FindingCategory

fn eq(&self, other: &FindingCategory) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for FindingCategory

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl Copy for FindingCategory

impl Eq for FindingCategory

impl StructuralPartialEq for FindingCategory