Rittenhouse· 10:00 AM – 10:50 AM
Action and Reaction: Pull Request, Push Secrets
A pull request was opened. Not merged. Not even reviewed, the CI checks just ran. An attacker walked out with the secrets. Attackers rarely break into a CI pipeline; the pipeline opens the door, hands them a token, and politely runs their code.
This talk tells that story through three of the past year's worst GitHub Actions supply-chain breaches: Nx S1ngularity, the reviewdog/tj-actions cascade, and Shai-Hulud v2. We don't just recap them, we recreate their root causes live, watching untrusted pull-request data walk straight into a privileged workflow and chain from one careless pull_request_
What it's about →