Security fixes that shipped.

This work landed in Haystack, the open-source AI framework deepset builds and other teams run for retrieval and agent pipelines. The project carries over 26,000 GitHub stars, and its Python package passes a million downloads a month. A weakness there ships to the teams that install it.

Each entry covers what was broken, what I changed, and what the flaw would have cost a business running the code.

Merged contributions

• merged deepset-ai/haystack · #11856 Jul 23, 2026

  Stopped a pull request filename from running commands on the build server

  A build step pasted the names of files from an incoming pull request into a script it then ran. Filenames can hold quotes and line breaks, so an outside contributor could name a file in a way that smuggled commands onto the maintainers' build machine.

  The riskAnyone could open a pull request and run code on the project's build infrastructure, without write access.

  The fixI passed the filenames through environment variables as data, following GitHub's documented pattern for untrusted input.

  Business impactBuild servers hold release artifacts and credentials. Closing this path takes away one of the cheapest attacks a stranger can run against the project.
  CI/CD Script injection Supply chain View PR ↗
• merged deepset-ai/haystack · #11857 Jul 3, 2026

  Hardened the release pipeline against a typed-in value

  The workflow that publishes new versions dropped the version number a maintainer types into a shell command. Shell syntax in that field runs instead of reading as text, inside the pipeline that signs and ships the product.

  The riskControl the release job and you control what downstream users install. The tj-actions incident the ecosystem spent last year cleaning up started in this class of flaw.

  The fixI routed the input through an environment variable so the shell reads it as text, matching the pattern used elsewhere in the same file.

  Business impactThe release job is the highest-value target in the repo. A maintainer-only path should not sit one typo away from arbitrary execution.
  Release security Shell injection Defence in depth View PR ↗
• merged deepset-ai/haystack · #11787 Jun 30, 2026

  Stopped an indexed document from leaking private server files

  Image pipelines read whatever file path an indexed document carried. A document holding a path like ../../../etc/passwd made the application open files unrelated to that document, then forward the contents to an external AI provider inside a routine request.

  The riskAnyone who can put a document into the search index, through a customer upload or a synced folder, can pull server-side secrets out through the AI model.

  The fixI forced resolved paths to stay inside the configured root and rejected traversal and absolute-path payloads before any read. Three regression tests shipped with it, and existing setups behave the same.

  Business impactCredentials and config files leave your infrastructure through a feature that looks like it reads images. That is the flaw that ends in a breach-notification letter.
  Path traversal AI data exfiltration Tested fix View PR ↗
• merged deepset-ai/haystack · #11723 Jun 25, 2026

  Gave the project a continuous supply-chain health check

  I added an OpenSSF Scorecard workflow. It grades the repository each week against seventeen supply-chain criteria, including branch protection, pinned dependencies, and signed releases, then publishes the results to GitHub's Security tab.

  The riskSecurity controls slip. One merged pull request can undo branch protection, and without a weekly grade the team finds out months later.

  The fixOne added workflow, actions pinned to commit hashes, least-privilege permissions per job, no other file touched. Maintainers merge changes shaped like that.

  Business impactThe project now carries a public score that refreshes every week, and enterprise adopters cite it during vendor due diligence.
  OpenSSF Scorecard Continuous assurance Vendor due diligence View PR ↗
• merged deepset-ai/haystack · #11722 Jun 25, 2026

  Cut the cost of the snippet new users copy first

  The starter examples used an expensive legacy model. Developers who copied the snippet paid around two hundred times more per run than the current model costs, for a hello-world script.

  The riskTeams keep the model they copied out of the docs. That one snippet sets the cost baseline for the whole project.

  The fixI switched the examples to the current cost-efficient model across live and versioned docs. No component behaviour changed.

  Business impactSame output for a fraction of the spend. Finding the default that costs money is the same discipline as finding the one that leaks data.
  FinOps Cost per token Developer defaults View PR ↗
• merged deepset-ai/haystack · #11733 Jun 23, 2026

  Removed the repository token from 18 build pipelines

  The checkout step writes the repository's access token to disk so later steps can use it. That token sits there for the rest of the job, readable by any later step, including third-party code the project never wrote.

  The riskOne compromised third-party action reads that token, then pushes code or tampers with releases. CVE-2025-30066 spread this way.

  The fixI audited all 30 workflows, found the 18 with no use for the token, and turned off credential persistence there. The workflows that push commits keep it.

  Business impactA dependency compromise now costs the project nothing instead of the whole repository. Most teams can copy this in an hour.
  Least privilege Token exposure 18 workflows View PR ↗

Live feed of merged pull requests is on the home page · full history at github.com/camgrimsec

How I work

• A finding counts once a maintainer merges it. Each item above passed review on a project with paying users behind it. Reviewers ask whether the change is safe, scoped, and worth their afternoon.
• I fix the whole class. One risky pattern in one workflow sent me through all thirty, then into fixes on the eighteen that needed them and a weekly check to catch the next one.
• I write impact in business terms. Each pull request named the blast radius and the parts I left alone. Maintainers merged them inside days.
• Security and cost come out of the same review. The pass that found the exfiltration path also found a documented default burning money on each run.
• You can read the diffs. These are public commits in someone else's codebase, held to the evidence standard I bring to client work.