Vulnerable sample for Action test

[souro1212]

This PR intentionally adds risky patterns for testing ai-secure-code-review-action.

[coderabbitai]

Warning

Rate limit exceeded

@souro1212 has exceeded the limit for the number of commits or files that can be reviewed per hour. Please wait 18 minutes and 29 seconds before requesting another review.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

📥 Commits

Reviewing files that changed from the base of the PR and between 5a76be0 and c2a8398.

📒 Files selected for processing (1)

• .github/workflows/ci.yml (1 hunks)

✨ Finishing touches

🧪 Generate unit tests

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch feat/vuln-demo-1757571418

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

🔐 Secure Code Review (AI)

Risk Summary: High (1)

1. Finding: Exposure of Secrets
   • Why it matters: The echo command is used to print the GITHUB_TOKEN, which can expose sensitive information in the CI logs. If logs are accessible to unauthorized users, this could lead to unauthorized access to the repository or other resources.
   • Evidence (diff lines):

•  - name: Echo secret
  

•    run: echo ${{ secrets.GITHUB_TOKEN }}
  

  - **Fix (concrete)**: Remove the step that echoes the secret. If you need to use the token, do so without printing it to the logs. For example, use it directly in a command that requires authentication without exposing it.
  
  

Safeguards Checklist:

• Secrets are not logged: Fail
• CI/CD workflows do not expose sensitive information: Fail

---

Models can make mistakes. Verify before merging.