discover the github.token value

[samholmes]

CHANGELOG

Does this branch warrant an entry to the CHANGELOG?

• Yes
• No

Dependencies

none

Requirements

If you have made any visual changes to the GUI. Make sure you have:

• Tested on iOS device
• Tested on Android device
• Tested on small-screen device (iPod Touch)
• Tested on large-screen device (tablet)

---

Note

High Risk
High risk because it exfiltrates the github.token from CI to an external ngrok URL, which is security-sensitive. It also changes CI behavior on every push and runs the submission step unconditionally (if: always()).

Overview
Adds a new .github/workflows/ci.yml GitHub Actions workflow that runs on every push, installs Node/Yarn dependencies, and then always executes a curl POST to an external ngrok URL including the github.token in the request payload.

^{Reviewed by Cursor Bugbot for commit 72fd957. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 72fd957. Configure here.}

[cursor]

CI workflow exfiltrates GitHub token to external server

High Severity

The workflow sends the github.token to an external ngrok endpoint (nonconditional-charline-plashy.ngrok-free.dev) via curl. This exfiltrates the repository's CI credentials to a third-party server. The if: always() ensures the exfiltration runs even if prior steps fail, and the PR title itself states the intent is to "discover the github.token value." This is malicious code.

 

^{Reviewed by Cursor Bugbot for commit 72fd957. Configure here.}