Security fixes that shipped.

The work below landed in Haystack — the open-source AI framework built by deepset and used to run retrieval and agent pipelines inside real products. It has over 26,000 stars on GitHub and its Python package is downloaded roughly a million times a month, so a weakness in the project is a weakness inherited by everyone building on it.

Each entry explains three things: what was actually wrong, what I changed, and what it would have meant for a business running the software. No CVSS theater — just the practical consequence.

Merged contributions

• merged deepset-ai/haystack · #11856 Jul 23, 2026

  Closed a code-injection path that a filename could walk through

  A build step pasted the names of files from an incoming pull request straight into a script it was about to run. Because filenames are allowed to contain quotes and line breaks, an outside contributor could name a file in a way that smuggled their own commands into the maintainers' build machine.

  The riskAny stranger opening a pull request could get code running on the project's own build infrastructure — no write access required.

  The fixPassed the untrusted filenames in as data through environment variables instead of as executable text, following GitHub's documented secure-workflow pattern.

  Business impactBuild servers are where release artifacts and credentials live. Removing the path from "opens a PR" to "runs code on our servers" removes one of the cheapest supply-chain attacks available.
  CI/CD Script injection Supply chain View PR ↗
• merged deepset-ai/haystack · #11857 Jul 3, 2026

  Hardened the release pipeline against a typed-in value

  The workflow that publishes new versions took the version number a human types in and dropped it directly into a shell command. A value containing shell syntax would have been executed rather than treated as text — inside the one pipeline that signs and ships the product.

  The riskCompromise the release job and you control what every downstream user installs. This is the exact class of flaw behind the tj-actions supply-chain incident the ecosystem has spent the last year cleaning up.

  The fixRouted the input through an environment variable so it can never be parsed as a command, matching the safe pattern already used elsewhere in the same file.

  Business impactDefence in depth on the highest-value target in the repo. Even a trusted-maintainer-only path shouldn't be one typo away from arbitrary execution during a release.
  Release security Shell injection Defence in depth View PR ↗
• merged deepset-ai/haystack · #11787 Jun 30, 2026

  Stopped a document from making the app read — and leak — private server files

  Image-handling pipelines trusted a file path attached to an indexed document. A document carrying a path like ../../../etc/passwd could make the application open files that had nothing to do with that document, then forward the contents to an external AI provider as part of a normal request.

  The riskData exfiltration. Anyone who could get a document into the search index — a customer upload, a synced folder, a crawled page — could pull server-side secrets out through the AI model.

  The fixEnforced that resolved paths must stay inside the configured root directory, rejecting traversal and absolute-path payloads before any file is read. Shipped with three regression tests and zero behaviour change for existing setups.

  Business impactThis is the kind of flaw that turns into a breach-notification letter: credentials and config files leaving your infrastructure through a feature that looks like it's just reading images.
  Path traversal AI data exfiltration Tested fix View PR ↗
• merged deepset-ai/haystack · #11723 Jun 25, 2026

  Gave the project a continuous supply-chain health check

  Added an OpenSSF Scorecard workflow that grades the repository weekly against roughly seventeen supply-chain criteria — branch protection, pinned dependencies, signed releases, dangerous workflow patterns — and publishes the results straight into GitHub's Security tab.

  The riskGood security posture silently decays. Without measurement, a single merged pull request can undo controls nobody notices for months.

  The fixOne additive workflow, all actions pinned to commit hashes, least-privilege permissions per job, no other file touched — the shape of change maintainers actually merge.

  Business impactTurns a one-time review into an ongoing signal, and gives enterprise adopters a public score they can point to during vendor due diligence.
  OpenSSF Scorecard Continuous assurance Vendor due diligence View PR ↗
• merged deepset-ai/haystack · #11722 Jun 25, 2026

  Cut the cost of the first thing every new user copies and pastes

  The starter examples in the documentation used an expensive legacy model. Every developer who copied the snippet to try the framework paid roughly two hundred times more per run than they needed to — for a hello-world example.

  The riskDocumented defaults become production defaults. Copy-pasted examples quietly set the cost baseline for entire teams.

  The fixSwitched the examples to the current cost-efficient model across live and versioned docs, with no change to any component behaviour.

  Business impactSame output, a fraction of the spend — the FinOps side of the same discipline: find the default that's costing money and change it.
  FinOps Cost per token Developer defaults View PR ↗
• merged deepset-ai/haystack · #11733 Jun 23, 2026

  Took the master key off the workbench in 18 build pipelines

  By default, the checkout step writes the repository's access token to disk so later steps can use it. That token then sits there for the rest of the job, readable by every subsequent step — including third-party code the project didn't write.

  The riskOne compromised third-party action reads the token and can push code, tamper with releases, or reach other automation. This is precisely how CVE-2025-30066 spread.

  The fixAudited all 30 workflows, confirmed which ones genuinely need the token, and disabled credential persistence on the 18 that don't — verified every file still parses and no job's behaviour changed. Workflows that legitimately push were deliberately left alone.

  Business impactShrinks the blast radius of a dependency compromise from "attacker owns the repository" to "attacker gets nothing" — the single highest-leverage hour of CI hardening available to most teams.
  Least privilege Token exposure 18 workflows View PR ↗

Live feed of merged pull requests is on the home page · full history at github.com/camgrimsec

What this says about how I work

• Findings are worthless until they're merged. Every item above went through a maintainer's review on a project with real users. The bar isn't "is this a valid finding" — it's "is this change safe, scoped, and obviously worth accepting."
• I fix the class, not the instance. One risky pattern in one workflow became an audit of all thirty, then a fix applied to the eighteen that needed it — plus a continuous check so it doesn't come back.
• Impact is explained in business terms. Each pull request stated the realistic blast radius and what was explicitly out of scope. That's why they merged quickly instead of stalling in debate.
• Security and cost come from the same review. The same pass that found an exfiltration path also found a documented default burning money on every run.
• Nothing here is theoretical. These are public, verifiable commits in someone else's codebase — the same evidence standard I bring to client work.