Bitrise Expert

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The bitrise.yml sets default_step_lib_source to https://github.com/bitrise-io/bitrise-steplib.git, which Bitrise fetches at runtime to load and execute step scripts (remote code) that the workflows rely on.