I'm surprised the article focused on compromising the build farm instead of danger to the production. I guess a malicious agent could alter the behavior of the

I'm surprised the article focused on compromising the build farm instead of danger to the production. I guess a malicious agent could alter the behavior of the build that makes it to production and attempt to slide in an extra "feature" like weakened security or back door. Nevertheless, it's a good reminder to consider build servers as part of the attack surface.