Treat scanner findings as untrusted content in Copilot-assigned issues #292

Summary

A review discussion on #291 raised a potential trust-boundary issue: scanner-derived content can be included in issues that may be assigned to Copilot. The existing Axe path already includes DOM-derived HTML and selectors; adding AccessLint introduces another source of findings, which may broaden the content reaching Copilot.

This is not a claim that AccessLint creates a new vulnerability class or should be removed. The local fixture lowers risk only if untrusted pull requests cannot modify it. The durable concern is whether finding content is treated as untrusted end-to-end; Markdown wrapping alone may not be sufficient.

Follow-up

• Trace how findings from built-in scanners are collected and included in issues or other content that Copilot may process.
• Establish and document the trust boundary for fixtures and data originating from untrusted pull requests.
• Ensure scanner-derived text cannot be interpreted as instructions, and add tests covering instruction-like content in findings.
• Verify the handling applies consistently across scanners, rather than only to AccessLint.

References

• Review discussion on #291
• PR #291: Add accesslint to the list of scans in test workflow

🤖 Assisted by Copilot