Report security problems privately, not in a public issue. On GitHub, open the repository's Security tab and choose Report a vulnerability. Only the maintainers can see the report.

Include what you found, how to reproduce it, and what an attacker could do with it.

A security problem in this module is anything that gives the service role more access than its inputs say it should have: for example, a trust policy that lets something other than CodeDeploy assume the role, a policy broader than documented, or a validation that lets an unsafe value through.

Fixes are made to the latest release.