Action and Reaction: Pull Request, Push Secrets

About this talk

A pull request was opened. Not merged. Not even reviewed, the CI checks just ran. An attacker walked out with the secrets. Attackers rarely break into a CI pipeline; the pipeline opens the door, hands them a token, and politely runs their code. This talk tells that story through three of the past year's worst GitHub Actions supply-chain breaches: Nx S1ngularity, the reviewdog/tj-actions cascade, and Shai-Hulud v2. We don't just recap them, we recreate their root causes live, watching untrusted pull-request data walk straight into a privileged workflow and chain from one careless pull_request_

The speaker

• AR

  Arnab Roy

Where it is