The Approval Bound the Wrong Commit: GitHub Actions TOCTOU
A privileged workflow can inherit secrets, write tokens, and attacker-controlled artifacts. Learn how to bind the GitHub Actions handoff to immutable evidence.
-
-
GitLost: When a Public Issue Can Read a Private Repo
GitLost turned a public GitHub issue into a private-repository disclosure. Trace the confused-deputy chain, reproduce it safely, and harden agentic CI.
