SEC005 — missing-permissions

Severity: warning · Category: Security

What it checks

Flags a job that has no permissions: set at either the workflow level or the job level.

Why it matters

Without an explicit permissions: block, GITHUB_TOKEN gets whatever default scope GitHub (or your org's settings) assigns — which can be broad read/write access across contents, issues, pull requests, and more. Declaring permissions explicitly, even as permissions: {}, makes the actual scope auditable instead of implicit.

Examples

Flagged — no idea what this job's GITHUB_TOKEN can actually do:

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.2.2
      - run: make build

Fixed — locked down at the workflow level, with only the specific job that needs write access getting it:

permissions: {}

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.2.2
      - run: make build

  publish:
    needs: build
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - run: make release

Suppressing

The finding is reported on the job's own declaration line:

  build: # vlotpipe: ignore[SEC005]
    runs-on: ubuntu-latest

Reasonable if the job genuinely needs the org's broad default token scope for a reason that's hard to express as a fixed permissions: list — otherwise, set permissions: {} instead of suppressing.