In general, the fix is to explicitly set a least-privilege permissions block so that the GITHUB_TOKEN has only the minimal rights needed. For this workflow, all steps are local (checkout, install dependencies, run lint), so read access to repository contents is sufficient.

The best fix without changing functionality is to add permissions: contents: read at the workflow root, above jobs:. This will apply to all jobs that don’t define their own permissions. No steps in run-linters need write access to contents, issues, or pull requests, so contents: read is adequate. The only change is to .github/workflows/linting.yml, inserting a permissions block after the on: section and before jobs:; no imports or additional definitions are needed.

In general, you fix this by adding a permissions: block that grants only the minimal scopes required for the workflow, either at the root (affecting all jobs) or at the specific job level. For a typical Sentry release workflow that only checks out code and calls an external action using SENTRY_AUTH_TOKEN, no GitHub write permissions are needed; contents: read is usually sufficient (and is equivalent to a read-only default).

For this specific workflow in .github/workflows/sentry.yml, the least invasive change is to add permissions: contents: read to the sentry-release job. That constrains the GITHUB_TOKEN for this job only, without altering behavior: actions/checkout still works with contents: read, and getsentry/action-release uses the Sentry auth token from secrets, not GITHUB_TOKEN. Concretely, modify the sentry-release job definition (around line 13–16) to insert:

    permissions:
      contents: read

directly under runs-on: ubuntu-latest (or directly under the job name; placement within the job block is flexible as long as indentation is correct).

In general, to fix log injection when logging user-controlled values, sanitize or normalize those values before logging. For plain-text logs, a common and simple mitigation is to remove carriage-return and newline characters from user input and to clearly delimit or quote user-controlled fields in log messages.

For this specific code, the best fix with minimal functional impact is:

• Before logging event.body, derive a sanitized version that strips \r and \n characters.
• Log the sanitized body instead of the raw event.body.
• Optionally, clearly label the value as user input in the log message (which is already effectively done by "Received query: ...").

Concretely, in hub-search-proxy/handler.js around line 53 inside module.exports.search, introduce a new variable (e.g., sanitizedBody) that uses String.prototype.replace with a regular expression to remove \r and \n from event.body, and then log that sanitized value. No new imports are needed; replace is part of standard JavaScript. The rest of the function should continue to use the original event.body for parsing so that existing behavior is unchanged.