Viewing profile — electricapps

Great writeup. Though combined with the lack of lockfiles for transitive actions, relying purely on static analysis is tough. Linter like zizmor are great, but they struggle with d…

I worked on hasp after seeing the Trivy and LiteLLM PyPI-credential leak. It was clear that the failure there wasn't unique since any CI step can get compromised, and everything el…