I write an application-security tool called SecHelix. Last week I added a GitHub Action to it. Before...
I write an application-security tool called SecHelix. Last week I added a GitHub
Action to it. Before merging, I pointed the tool at its own new Action.
It found two real defects. Neither would have failed a test. Both were the kind
of thing I would have shipped.
This is a post about those two bugs, because they are better arguments for
How I turned 27 silent failures into logged ones, closed three real attack surfaces, and pushed test...
ActiveState explains how GitHub Actions attack chains can evade traditional CI security scanners, why passing a scan doesn't…
Two Codex review rounds surfaced eight defects in my YouTube pipeline — all the same category: assumptions about external system…
Your CI workflow is the softest target in your repo. It runs automatically, it has a GITHUB_TOKEN...
Use Datadog IaC Security to catch GitHub Actions misconfigurations in the diff, before they reach production.
A security researcher showed that a GitHub PR title, issue body, or comment could become a prompt...
