[MihirR-BS]

Addresses two findings from the LTS-5442 security AI review of this sample.

Changes

Story	Fix
LTS-5540 (Medium)	The README had users download and run the CLI with no integrity check. A new step 3, Verify the BrowserStack CLI, checks the OS-level signature the builds already carry: codesign on macOS (must show TeamIdentifier=YQ5FZQ855D, Browserstack Inc) and Get-AuthenticodeSignature on Windows. The README also now says the download is a zip that has to be extracted; it previously said to place "the binary".
LTS-5535 (Medium)	Semgrep image pinned: returntocorp/semgrep:1.166.0@sha256:c180f0c93a17b420c0af5006214a29d3c747c5459c732b740191adf657dd0068.

What the downloads carry today (checked 2026-10-27, CLI 1.62.0)

Platform	Provenance
macOS	Signed: Developer ID Application: Browserstack Inc (YQ5FZQ855D), chained to Apple Root CA
Windows	Authenticode-signed by BrowserStack (Sectigo chain)
Linux	Unsigned ELF, and no checksum published. The download is a presigned S3 redirect with a multipart ETag, which isn't a usable hash

Verification

• I ran the README's macOS command against the real downloaded binary: it prints TeamIdentifier=YQ5FZQ855D.
• The same command against a copy with the signature stripped fails codesign --verify.
• The Windows command was not run here (no PowerShell). The .exe does carry an Authenticode certificate table naming BrowserStack.

Not fixed here

Linux users still have nothing to verify against. That needs a published checksum (or a signature) from the CLI release process / binary endpoint, so it stays open on LTS-5540 as a follow-up rather than something this sample can fix.

No load-testing-backend change: this sample isn't bundled in sample/.

Part of LTS-5442.

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Central YAML (base), Organization UI (inherited), Workspace UI (inherited); Enforced overrides: Organization
• Review profile: ASSERTIVE
• Plan: Enterprise
• Run ID: 7ffd33c4-cbec-4ad5-9962-8a9a11521833

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}