DX003: Workflow token permissions too broad

Severity: medium · Category: developer_experience · Applies to: github_actions

Why it matters

Without an explicit permissions block the GITHUB_TOKEN may have write access to the repository, which a compromised step can abuse.

How to fix

Add permissions: contents: read at the top and grant more per job only.

Auto-fix

devshield fix can resolve this rule for the cases it can change safely. Preview it with devshield fix --dry-run --only DX003.

Ignoring this rule

Skip it everywhere in devshield.yml:

ignore:
  - DX003

Or skip one line with a comment on that line or the line above:

devshield-ignore: DX003