Keeping your GitHub Actions and workflows secure Part 1: Preventing pwn requests

0 stars0 forks0 contributors

Overview

Combining pull_request_target workflow trigger with an explicit checkout of an untrusted PR may lead to repository compromise

Related Projects

Community-curated · Updated weekly · 100% open source

Found a gem we're missing?

Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.

Submit a project Star on GitHub

Last commit

Created

Links & Resources

Website

Included in

CI/CD Attacks578

ActionsTOCTOU (Time Of Check to Time Of Use)

Example repository for GitHub Actions Time of Check to Time of Use (TOCTOU vulnerabilities)

Stars44

Forks7

Last commit6 months ago

Can you trust ChatGPT's package recommendations?

Exploit generative AI platforms' tendency to generate non-existent coding libraries to execute Dependecy Confusion

Stars0

Forks0

Last commit

Introducing MavenGate: a supply chain attack method for Java and Android applications

Many public and popular libraries that have long been abandoned are still being used in huge projects. Access to projects can be hijacked through domain name purchases

Stars0

Forks0

Last commit

WordPress Plugin Confusion: How an update can get you pwned

Unclaimed WordPress plugins are vulnerable to takeover via the plugin directory

Stars0

Forks0

Last commit