Hi
You added a new rule S8263 on 16 mar 2026
Azure Pipelines Task invocations should not be vulnerable to parameter injection attacks
I think it gives false positive.
Example we have
task: DotNetCoreCLI@2
displayName: ‘Build ${{ parameters.buildConfiguration }}’
inputs:
command: build
projects: ${{ parameters.projects }}
arguments: '–no-restore --configuration ${{ parameters.buildConfiguration }}’
The task does not seem to support env:
So should it valid that or only script task?