you are viewing a single comment's thread
view the rest of the comments
[–] 10 points 3 months ago

That sounds big & creepy:

On Microsoft's Azure Sentinel, for example, Novee found a comment on a PR that could run anonymous attacker code on Microsoft's CI and steal a non-expiring GitHub App key.

I wonder if/how alternative VCS platforms that provide similar workflow services are affected.

  • source