DX011: Untrusted input interpolated into a shell step

Severity: high · Category: security · Applies to: github_actions

Why it matters

Expressions like ${{ github.event.issue.title }} are pasted into the script before it runs, so a crafted title or branch name can execute commands.

How to fix

Assign the value to an env: variable and reference it as $VAR in the script.

Ignoring this rule

Skip it everywhere in devshield.yml:

ignore:
  - DX011

Or skip one line with a comment on that line or the line above:

devshield-ignore: DX011