GitHub is investigating unauthorized access to their internal repositories
1–10 of 359 posts
Re: GitHub is investigating unauthorized access to their internal repositories
#2[flagged]
Re: GitHub is investigating unauthorized access to their internal repositories
#3[flagged]
Are you a bot?
Re: GitHub is investigating unauthorized access to their internal repositories
#4Is it just me or is this happening way more frequently in the last 4 or 5 months? Coincidently around the same time the models got a lot more capable?
Re: GitHub is investigating unauthorized access to their internal repositories
#5Re: GitHub is investigating unauthorized access to their internal repositories
#6- Use Static analysis for GHA to catch security issues: https://github.com/zizmorcore/zizmor
- set locally: pnpm config set minimum-release-age 4320 # 3 days in minutes https://pnpm.io/supply-chain-security for other package managers check: https://gist.github.com/mcollina/b294a6c39ee700d24073c0e5a4e...
- add Socket Free Firewall when installing npm packages on CI https://docs.socket.dev/docs/socket-firewall-free#github-act...
Re: GitHub is investigating unauthorized access to their internal repositories
#7Is it just me or is this happening way more frequently in the last 4 or 5 months? Coincidently around the same time the models got a lot more capable?
I think it's more about the popularity than the capability. The chances you might accidentally put a Github access token into an undesired security context goes up dramatically when you actually create and use one on a regular basis. The developers at GH are certainly using these tools just like the rest of us.
Re: GitHub is investigating unauthorized access to their internal repositories
#8Mythos has broken containment
Re: GitHub is investigating unauthorized access to their internal repositories
#9- Use Static analysis for GHA to catch security issues: https://github.com/zizmorcore/zizmor - set locally: pnpm config set minimum-release-age 4320 # 3 days in minutes https://pnpm.io/supply-chain-security for other package managers check: https://gist.github.com/mcollina/b294a6c39ee700d24073c0e5a4e... - add Socket Free Firewall when installing npm packages on CI https://docs.socket.dev/docs/socket-firewall-free#git…
You also need to make sure you take care using PR titles and descriptions in your GHA because if they contain `text` it *may be executed lmfao.
edited: not "will", may depending on your GHA
Re: GitHub is investigating unauthorized access to their internal repositories
#10- Use Static analysis for GHA to catch security issues: https://github.com/zizmorcore/zizmor - set locally: pnpm config set minimum-release-age 4320 # 3 days in minutes https://pnpm.io/supply-chain-security for other package managers check: https://gist.github.com/mcollina/b294a6c39ee700d24073c0e5a4e... - add Socket Free Firewall when installing npm packages on CI https://docs.socket.dev/docs/socket-firewall-free#git…
You also need to make sure you take care using PR titles and descriptions in your GHA because if they contain `text` it *may be executed lmfao. edited: not "will", may depending on your GHA
Maybe zizmor could catch this https://github.com/zizmorcore/zizmor but not sure 100%