Pathros Demo Receipt — Northstar Energy

# Pathros Demo Receipt — Northstar Energy

## Scope

Fixture data only. No customer data. No writes.

## Summary

* Number of ranked risks: 3
* Critical risks: 1
* High risks: 1
* Medium risks: 1
* Workspace: Northstar Energy
* Mode: Demo
* Writes made by Pathros: 0

## Findings

### 1. GitHub OIDC token can assume AWS role with write access to customer PII.

* Severity: critical
* Confidence: 98%
* Access path: GitHub Actions token → AWSRole:ProdDeploy → CustomerDataWritePolicy → s3:PutObject → S3:CustomerPII
* Evidence:
  * AWS IAM: Statement[2].Action includes s3:PutObject (arn:aws:iam::123456789:policy/CustomerDataWritePolicy; 98% confidence)
  * GitHub: Trust policy allows sts:AssumeRole from token.actions.githubusercontent.com (github.com/northstar-energy/.github (OIDC trust); 95% confidence)
  * S3: Bucket tagged data-classification=customer-pii (arn:aws:s3:::customer-pii-prod; 99% confidence)
* Recommended remediation: Remove sts:AssumeRole from the GitHub trust policy or scope the role to deployment-only resources.
* Simulation result: 94 → 31. The GitHub → AWS → customer PII write path is severed. Production deploy remains available for approved resources. Possible business impact: release owners must approve any future customer-data write path. Rollback note: restore the prior trust-policy statement only after explicit security approval. Simulation only. Nothing executes.
* Provenance stamp: fixture · run-demo-0001 · snap-demo-2026-05-28 · schema 0.1.0
* Writes made by Pathros: 0

### 2. Dormant service account still has write access to production artifacts.

* Severity: high
* Confidence: 86%
* Access path: svc-legacy-batch → InheritedAdminPolicy → S3:ProdArtifacts
* Evidence:
  * Okta: lastAuthentication=2025-09-30T08:10:00Z; lifecycle=ACTIVE (okta://users/svc-legacy-batch; 88% confidence)
  * AWS IAM: Statement[0].Action includes s3:PutObject for prod-artifacts/* (arn:aws:iam::123456789:policy/InheritedAdminPolicy; 86% confidence)
* Recommended remediation: Disable svc-legacy-batch after owner approval or scope InheritedAdminPolicy to its last-used read-only artifact actions.
* Simulation result: 72 → 24. The dormant identity → inherited admin policy → production artifacts path is severed. Read-only artifact inspection can remain available through a scoped replacement role. Possible business impact: legacy batch jobs must be confirmed inactive before disablement. Approval note: account owner and production release owner should sign off before any change. Simulation only. Nothing executes.
* Provenance stamp: fixture · run-demo-0001 · snap-demo-2026-05-28 · schema 0.1.0
* Writes made by Pathros: 0

### 3. Vendor OAuth app can read a repo secret that reaches a deployment role.

* Severity: medium
* Confidence: 81%
* Access path: Vendor OAuth app → Repo secret: DEPLOY_KEY → AWSRole:Deploy
* Evidence:
  * GitHub: OAuth app scope includes repo:read and actions:read (github.com/northstar-energy/production-repo OAuth grant; 81% confidence)
  * AWS IAM: DEPLOY_KEY is accepted by deployment bootstrap trust relationship (arn:aws:iam::123456789:role/Deploy; 83% confidence)
* Recommended remediation: Rotate DEPLOY_KEY, restrict the OAuth app to approved repositories, and require owner review before it can read deployment secrets.
* Simulation result: 51 → 18. The vendor OAuth app → repo secret → AWS deployment role path is severed. Approved vendor repository reads can continue without deployment-secret access. Possible business impact: vendor automation may need a new scoped token before its next run. Rollback note: reissue access only through a time-bounded approval record. Simulation only. Nothing executes.
* Provenance stamp: fixture · run-demo-0001 · snap-demo-2026-05-28 · schema 0.1.0
* Writes made by Pathros: 0

## Restraint

Read-only by default. No irreversible automation. Simulation only.