Security review: commits since 2026-05-11

[Jayclifford345]

Scope

Reviewed all commits to this repository between 2026-05-11 00:00 UTC and 2026-05-18, per the code-freeze directive.

Full commit view (GitHub UI): https://github.com/grafana/interactive-tutorials/commits/main/?since=2026-05-11&until=2026-05-18

Methodology

1. Enumerated all commits in the window across all branches (git log --since="2026-05-11" --until="2026-05-18" --all).
2. AI-assisted commit-diff sweep + deep malicious-code review covering: backdoors / auth bypass, data exfiltration, persistence, supply-chain compromise, CI/CD tampering, obfuscation, cryptojacking / wallet drainers, hidden files, web shell / reverse shell patterns. Extra attention paid to tutorial JSON content (URLs, iframes, script tags, CSS selectors).
3. Cross-referenced PR numbers and author identities against the team roster.
4. Human review and sign-off.

Commits reviewed (main, 7)

SHA	Author	Summary	Verdict
16aac3d	Jay Clifford (merge of d70c6e9 by Michael Wettick)	IRM selector refresh (#309)	clean
adddfba	Jay Clifford	play-5k-run selector fix (#307)	clean
ac08944	Simon Prickett	NZ GeoNet play tour (#214)	clean
97a9368	Simon Prickett	CheerLights dashboard tour (#303)	clean
adcd8b4	Simon Prickett	GB-Railways selector fix (#310)	clean
cda0e0c	Simon Prickett	NZ Geonet selector fix (#311)	clean
24f6998	David Allen	Pathfinder docs parity + audit/update-guide skills (#308)	clean — docs only

External contributors

• Michael Wettick (d70c6e9, merged via Update targets for IRM escalation chain configuration #309) — established contributor with 9 prior commits to this repo going back to 2025-11-07. Commit is a 4-selector refresh in irm-configuration/content.json:117-145, moving from data-pathfinder attributes to div:text("...") / data-testid selectors. No new URLs, no action changes, no new fields.

Notable items examined

• PR Pathfinder docs parity + audit-guide and update-guide skills #308 (24f6998) — 25-file change is docs-only: .cursor/*.mdc, .cursor/skills/*.md, AGENTS.md, CLAUDE.md, docs/*.md. No executable file added. The misleadingly-named .cursor/commands/attack.md is a Cursor prompt that instructs the AI to role-play a confused user for tutorial UX stress-testing.
• All new URLs are Grafana-owned: grafana.com/docs/learning-paths/*, interactive-learning.grafana.net/courses/{oss,cloud}.json, github.com/grafana/grafana-pathfinder-app, plus http://localhost/health in a docs example. No off-domain hosts.
• New tutorial JSON (play-cheerlights, play-nz-geonet-tour) contains no iframe, <script>, javascript:, onerror=, or off-domain URLs. Only markdown, interactive, and section blocks targeting data-testid selectors.
• Side-branch feat/courses-cdn (not on main) — adds a CDN publish step using grafana/shared-workflows/actions/push-to-gcs@0527786f572985731b4bde3684d82567abe8e979 # push-to-gcs/v0.3.0 (SHA-pinned), same Grafana service account and bucket prefix as existing steps. Worth re-verifying when it merges: the pathfinder-app/dist/cli/cli/index.js build-courses invocation should execute from a vendored submodule, not fetch arbitrary code at CI time.

Findings

No malicious code detected.

Reviewer

@Jayclifford345 — 2026-05-18

Next steps

• Commit review complete
• Issue filed
• Tracking spreadsheet updated to "Complete" / "Reviewed By: Jay Clifford"
• Restoration requested in #i-2026-05-16-coinbasecartel-claimed-access-to-grafana-data