rules-waypoint

RISK: NOMAD_SKIP_VERIFY=true disables TLS certificate verification for the Nomad backend — connections are vulnerable to MITM. FIX: supply the Nomad CA certificate via NOMAD_CACERT instead of disabling verification.

RISK: Plaintext secrets in an `env` block inside waypoint.hcl are stored in the Waypoint server state database and shipped to runners in every deployment. FIX: use configdynamic() to pull secret values from Vault or AWS SSM at deploy time so they are never persisted in the Waypoint database.

ADVISORY: A `git { url = ... }` source without a pinned `ref`, `tag`, or `commit` will always pull the latest HEAD — a supply-chain mutation in that repo deploys immediately. FIX: pin to an immutable tag or commit SHA.

RISK: Hardcoded credentials in waypoint.hcl are committed to version control and exposed to everyone with repo access (CWE-798). FIX: use Waypoint's input variables ('variable' block) with sensitive=true, or reference secrets via configdynamic() from Vault/AWS SSM/env.

RISK: `privileged = true` on a Waypoint on-demand runner mounts the host's Docker socket and grants full root-level access to the host — a compromised build step owns the host (CWE-269). FIX: avoid privileged mode; use rootless Docker or Kaniko for image builds.

ADVISORY: Pushing images to Docker Hub without authentication silently uses anonymous push, which either fails or targets a public repository. FIX: configure a registry block with credentials pulled from a secret store so images land in the correct private repository.

RISK: Disabling TLS certificate verification in Waypoint HCL config allows MITM attacks against registry, Kubernetes, or Nomad backends (CWE-295). FIX: configure the correct CA certificate path (e.g. kubernetes { config { ... } }) instead of skipping verification.