223 projects in the study deploy themselves with Docker (195), Terraform (27), Kubernetes (24) or CI workflows.
37%
of these run their container as root
7%
have a CI workflow that a pull request title or branch name can hijack
45%
had a high or critical problem anywhere in the project
Share of projects with infrastructure files.
| Problem | Share of apps |
|---|---|
| Container runs as root | 37% |
| CI workflow can be hijacked through a pull request title or branch | 7% |
| Secret baked into a container image | 0% |
| CI runs untrusted pull request code with secrets | 0% |
A container running as root turns any code execution bug into control of the container. A CI workflow that pastes a pull request title into a shell lets an outsider run commands with the repository's secrets. Both are one-line fixes once found.
Data: Redproof's automated checks on public GitHub repositories, November 2026. No repository is named. Method and limits