Jarek Potiuk potiuk

Apache Airflow security audit — joined summary of two waves

This summary covers two waves of Tooling Agents ASVS-L3 audits against apache/airflow, triaged in May 2026. It compares the impact of fixes, false-positive counts and shape, and the overall trajectory.

Audits triaged in this session (all at the same 0920c77 / b1aec75 commit pair, with AGENTS.md finally in scanner context):

airflow-core L3 — tooling-agents#23
task-sdk L3 — tooling-agents#24
providers/google L3 — tooling-agents#34

PR Stats Dashboard — apache/airflow

Snapshot: 2026-05-18 11:23 UTC | Repo: apache/airflow | Viewer: @potiuk | Cutoff for closed: 6 weeks ago

⚠️ Data note: closed-PR sample is capped at 1000 results (GitHub search ceiling). Recent weeks are accurate; oldest weeks (W-0, W-1) are undercounted. Total closed-since-cutoff per GitHub: 1991, fetched: 1000.

🎯 At a glance

Metric	Value

	<!DOCTYPE html><html><head><meta charset="utf-8"><title>apache/airflow — dashboard</title>
	<style>
	* { box-sizing: border-box; }
	body {
	font: 14px/1.5 -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif;
	background: #0d1117;
	color: #c9d1d9;
	margin: 0;
	padding: 24px;
	max-width: 1240px;

	<!DOCTYPE html>
	<html lang="en"><head><meta charset="utf-8">
	<title>apache/airflow PR backlog dashboard — 2026-05-24 19:56 UTC</title>
	<style>
	body { font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif; background: #f3f4f6; color: #1f2937; margin: 0; padding: 20px; line-height: 1.5; }
	.container { max-width: 1280px; margin: 0 auto; }
	h1 { font-size: 24px; margin: 0 0 4px 0; }
	h2 { font-size: 18px; margin: 32px 0 12px 0; padding-bottom: 6px; border-bottom: 2px solid #e5e7eb; color: #374151; }
	h3 { font-size: 14px; margin: 16px 0 8px 0; color: #4b5563; }
	.context { color: #6b7280; font-size: 13px; margin-bottom: 24px; }

	<!DOCTYPE html>
	<html><head><meta charset="utf-8"><title>apache/airflow — PR backlog dashboard</title>
	<style>
	body { background:#0d1117; color:#c9d1d9; font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',sans-serif;
	margin:0; padding:24px; max-width:1400px; margin:0 auto; }
	h1 { color:#f0f6fc; margin:0 0 8px; }
	h2 { color:#f0f6fc; margin:28px 0 12px; border-bottom:1px solid #30363d; padding-bottom:6px; }
	.context { color:#8b949e; font-size:13px; margin-bottom:20px; }
	.hero-row { display:flex; gap:12px; margin-bottom:12px; flex-wrap:wrap; }
	table { border-collapse:collapse; width:100%; font-size:13px; margin-top:8px; }

	<!DOCTYPE html>
	<html lang="en">
	<head>
	<meta charset="UTF-8">
	<meta name="viewport" content="width=device-width, initial-scale=1.0">
	<title>📊 apache/airflow PR stats v3 — 2026-05-18</title>
	<style>
	* { box-sizing: border-box; }
	body { font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif; margin: 0; padding: 24px; background: #f6f8fa; color: #1f2328; line-height: 1.5; max-width: 1280px; margin: 0 auto; }
	h1 { font-size: 28px; margin: 0 0 4px; }

	<!DOCTYPE html>
	<html lang="en">
	<head>
	<meta charset="UTF-8">
	<meta name="viewport" content="width=device-width, initial-scale=1.0">
	<title>📊 apache/airflow PR stats v3 — 2026-05-18</title>
	<style>
	* { box-sizing: border-box; }
	body { font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif; margin: 0; padding: 24px; background: #f6f8fa; color: #1f2328; line-height: 1.5; max-width: 1280px; margin: 0 auto; }
	h1 { font-size: 28px; margin: 0 0 4px; }