Félix Malfait
fc6b136c2f
## 🔒 Security Fixes This PR addresses security vulnerabilities identified by GitHub CodeQL security scanning. ### Changes #### 1. Fix Shell Command Injection (High Severity) **File:** `.github/workflows/docs-i18n-pull.yaml` **Issue:** Direct interpolation of `${{ github.head_ref }}` in shell command was susceptible to command injection attacks. **Fix:** Assign GitHub context variable to environment variable first: ```yaml run: | git push origin "HEAD:$HEAD_REF" env: HEAD_REF: ${{ github.head_ref }} ``` This prevents malicious input from being executed as shell commands. #### 2. Add Missing Workflow Permissions (Medium Severity) **File:** `.github/workflows/ci-test-docker-compose.yaml` **Issue:** Workflow did not explicitly define GITHUB_TOKEN permissions, running with overly broad defaults. **Fix:** Added explicit minimal permissions: ```yaml permissions: contents: read ``` This applies to all 3 jobs in the workflow: - `changed-files-check` - `test` - `ci-test-docker-compose-status-check` ### Security Impact - ✅ Prevents potential shell injection attacks via pull request branch names - ✅ Follows principle of least privilege for GitHub Actions tokens - ✅ Aligns with GitHub Actions security best practices - ✅ Resolves all CodeQL security alerts for these workflows ### References - [GitHub Actions: Security hardening for GitHub Actions](https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions) - [GitHub Actions: Permissions for the GITHUB_TOKEN](https://docs.github.com/en/actions/security-guides/automatic-token-authentication#permissions-for-the-github_token) - Related attacks: 2025 Nx supply chain attack, 2024 ultralytics/actions attack
The #1 Open-Source CRM
🌐 Website · 📚 Documentation · 
Roadmap · 
Discord · 
Figma
Installation
See: 🚀 Self-hosting 🖥️ Local Setup
Does the world need another CRM?
We built Twenty for three reasons:
CRMs are too expensive, and users are trapped. Companies use locked-in customer data to hike prices. It shouldn't be that way.
A fresh start is required to build a better experience. We can learn from past mistakes and craft a cohesive experience inspired by new UX patterns from tools like Notion, Airtable or Linear.
We believe in Open-source and community. Hundreds of developers are already building Twenty together. Once we have plugin capabilities, a whole ecosystem will grow around it.
What You Can Do With Twenty
Please feel free to flag any specific needs you have by creating an issue.
Below are a few features we have implemented to date:
- Personalize layouts with filters, sort, group by, kanban and table views
- Customize your objects and fields
- Create and manage permissions with custom roles
- Automate workflow with triggers and actions
- Emails, calendar events, files, and more
Personalize layouts with filters, sort, group by, kanban and table views
Customize your objects and fields
Create and manage permissions with custom roles
Automate workflow with triggers and actions
Emails, calendar events, files, and more
Stack
- TypeScript
- Nx
- NestJS, with BullMQ, PostgreSQL, Redis
- React, with Recoil, Emotion and Lingui
Thanks
Thanks to these amazing services that we use and recommend for UI testing (Chromatic), code review (Greptile), catching bugs (Sentry) and translating (Crowdin).
Join the Community
- Star the repo
- Subscribe to releases (watch -> custom -> releases)
- Follow us on Twitter or LinkedIn
- Join our Discord
- Improve translations on Crowdin
- Contributions are, of course, most welcome!