There are several high-sev alerts related to Wasm binary files being stored directly in the source code repository.
E.g. https://github.com/containerd/runwasi/security/code-scanning/1, https://github.com/containerd/runwasi/security/code-scanning/2, https://github.com/containerd/runwasi/security/code-scanning/3, and https://github.com/containerd/runwasi/security/code-scanning/4
How to Remedy This Issue:
- Implement a build-from-source approach. For example, for
hello_wasi_http_csharp.wasm file, we can store only the C# source code and have a script to compile it to the Wasm file for testing.
- Consider adding .wasm files to
.gitignore to prevent accidental commits in the future