3 ms·
Interesting that no hash/checksum verification has been added in their CI actions, like here, yet: https://github.com/codecov/codecov-action/blob/master/src/ind
by lhobas 5y ago
Interesting that no hash/checksum verification has been added in their CI actions, like here, yet: https://github.com/codecov/codecov-action/blob/master/src/index.ts#L11-L16 https://github.com/codecov/codecov-action/blob/master/src/in...
- throwbacktictac 5y agoLooks like a PR [1] was started 4 hours ago but for such a simple task not much progress has been made. Security breaches happen. If it hasn't happened yet consider it luck. I'm disappointed by the lack of urgency in the response and failure to take nominal steps in improving their posture. I hope this is a wake up call for them and other Saas companies. [1]https://github.com/codecov/codecov-action/pull/282 https://github.com/codecov/codecov-action/pull/282