33974213672
92%

Ran 05 Sep 2026 03:15PM UTC

Jobs 1

Files 11

Run time 1min

Badge

Embed ▾

Committed 05 Sep 2026 03:14PM UTC coverage: 95.17%. Remained the same

Build # 33974213672

Build Type

push

github

Committed by

web-flow

Commit Message

docs: record why ATS certificate pinning is deliberately not used

Semgrep reports Info.plist under ATS-consider-pinning, which flags the
absence of NSPinnedDomains. The finding is accepted rather than fixed,
and is expected to stay open — it is advice, not a defect, and nothing
in the file weakens ATS: there is no NSAppTransportSecurity key at all,
which is the strict setting.

Pinning binds the app to a specific public key for aa-bristol.org. That
certificate is renewed on the intergroup's hosting on a schedule nobody
here controls, and a renewal that changed the key would leave every
installed copy silently unable to reach the server until an update
shipped and members installed it. The attack pinning defends against
needs a CA to mis-issue for this domain; the outage it risks needs only
an ordinary certificate rotation.

Recorded in the file the finding points at, so the next person to see it
in the dashboard finds the reasoning rather than re-deriving it — or
worse, adding NSPinnedDomains on its own, which is the version that
breaks in the field. The note says what would change the answer: a
backup pin and a release process that rotates the pair together.

Coverage Stats

729 of 766 relevant lines covered (95.17%)

11.27 hits per line

Jobs

ID	Job ID	Ran	Files	Coverage
1	33974213672.1	05 Sep 2026 03:15PM UTC	11	95.17	GitHub Action Run

bleedingdeacons / link / 33974213672
92%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Jobs

Source Files on build 33974213672

bleedingdeacons / link / 33974213672 92%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Jobs

Source Files on build 33974213672

bleedingdeacons / link / 33974213672
92%

README BADGES
x