Console
Read-only · evidence-based · simulated before action
Fixture data only. No customer data. No password. Writes made by Pathros: 0.
You have 3 notes in your inbox/releases.
Release note
Pathros mapped the GitHub → AWS → customer PII path, attached evidence, and ran a remediation simulation. No writes were made.
Inbox note
svc-legacy-batch retains standing write access to production artifacts after 240 days idle.
Inbox note
Pathros is tracing the full reach of the vendor OAuth app into deployment credentials.
Transporting to your console…
NORTHSTAR ENERGY · Read-only. Fixture data only. No writes.
Ranked finding 01 · critical · Score 94
A GitHub Actions workflow token can assume AWSRole:ProdDeploy, which inherits a policy that can write to customer PII in S3.
Every risk has an evidence path.
Access path
| Step | Node | Source | Relationship |
|---|---|---|---|
| 1 | GitHub Actions token | GitHub | Origin |
| 2 | AWSRole:ProdDeploy | AWS IAM | can assume |
| 3 | CustomerDataWritePolicy | AWS IAM | has policy |
| 4 | s3:PutObject | AWS IAM | allows |
| 5 | S3:CustomerPII | S3 | applies to |
You have no notes left in your inbox/releases.
moved to Ranked Finding 01
moved to Ranked Finding 02
moved to Ranked Finding 03
Global export
# Pathros Demo Receipt — Northstar Energy ## Scope Fixture data only. No customer data. No writes. ## Summary * Number of ranked risks: 3 * Critical risks: 1 * High risks: 1 * Medium risks: 1 * Workspace: Northstar Energy * Mode: Demo * Writes made by Pathros: 0 ## Findings ### 1. GitHub OIDC token can assume AWS role with write access to customer PII. * Severity: critical * Confidence: 98% * Access path: GitHub Actions token → AWSRole:ProdDeploy → CustomerDataWritePolicy → s3:PutObject → S3:CustomerPII * Evidence: * AWS IAM: Statement[2].Action includes s3:PutObject (arn:aws:iam::123456789:policy/CustomerDataWritePolicy; 98% confidence) * GitHub: Trust policy allows sts:AssumeRole from token.actions.githubusercontent.com (github.com/northstar-energy/.github (OIDC trust); 95% confidence) * S3: Bucket tagged data-classification=customer-pii (arn:aws:s3:::customer-pii-prod; 99% confidence) * Recommended remediation: Remove sts:AssumeRole from the GitHub trust policy or scope the role to deployment-only resources. * Simulation result: 94 → 31. The GitHub → AWS → customer PII write path is severed. Production deploy remains available for approved resources. Possible business impact: release owners must approve any future customer-data write path. Rollback note: restore the prior trust-policy statement only after explicit security approval. Simulation only. Nothing executes. * Provenance stamp: fixture · run-demo-0001 · snap-demo-2026-05-28 · schema 0.1.0 * Writes made by Pathros: 0 ### 2. Dormant service account still has write access to production artifacts. * Severity: high * Confidence: 86% * Access path: svc-legacy-batch → InheritedAdminPolicy → S3:ProdArtifacts * Evidence: * Okta: lastAuthentication=2025-09-30T08:10:00Z; lifecycle=ACTIVE (okta://users/svc-legacy-batch; 88% confidence) * AWS IAM: Statement[0].Action includes s3:PutObject for prod-artifacts/* (arn:aws:iam::123456789:policy/InheritedAdminPolicy; 86% confidence) * Recommended remediation: Disable svc-legacy-batch after owner approval or scope InheritedAdminPolicy to its last-used read-only artifact actions. * Simulation result: 72 → 24. The dormant identity → inherited admin policy → production artifacts path is severed. Read-only artifact inspection can remain available through a scoped replacement role. Possible business impact: legacy batch jobs must be confirmed inactive before disablement. Approval note: account owner and production release owner should sign off before any change. Simulation only. Nothing executes. * Provenance stamp: fixture · run-demo-0001 · snap-demo-2026-05-28 · schema 0.1.0 * Writes made by Pathros: 0 ### 3. Vendor OAuth app can read a repo secret that reaches a deployment role. * Severity: medium * Confidence: 81% * Access path: Vendor OAuth app → Repo secret: DEPLOY_KEY → AWSRole:Deploy * Evidence: * GitHub: OAuth app scope includes repo:read and actions:read (github.com/northstar-energy/production-repo OAuth grant; 81% confidence) * AWS IAM: DEPLOY_KEY is accepted by deployment bootstrap trust relationship (arn:aws:iam::123456789:role/Deploy; 83% confidence) * Recommended remediation: Rotate DEPLOY_KEY, restrict the OAuth app to approved repositories, and require owner review before it can read deployment secrets. * Simulation result: 51 → 18. The vendor OAuth app → repo secret → AWS deployment role path is severed. Approved vendor repository reads can continue without deployment-secret access. Possible business impact: vendor automation may need a new scoped token before its next run. Rollback note: reissue access only through a time-bounded approval record. Simulation only. Nothing executes. * Provenance stamp: fixture · run-demo-0001 · snap-demo-2026-05-28 · schema 0.1.0 * Writes made by Pathros: 0 ## Restraint Read-only by default. No irreversible automation. Simulation only.