4 ms·
Yikes. This is bad. On a friday night no less. Some questions that come to mind: * Would encrypted secrets for GitHub Actions be exposed to these tokens? * H
by rsanheim 5y ago
Yikes. This is bad. On a friday night no less.
Some questions that come to mind:
* Would encrypted secrets for GitHub Actions be exposed to these tokens?
* How to best audit for unauthorized access to exposed repos?
* Were Heroku encrypted secrets exposed?
- judge2020 5y agoNothing can pull the value of secrets from GitHub actions without either running a compromised/modified runner, or the workflow itself encrypting/printing/shipping that actions secret off to somewhere. If you’re really worried, use oidc GitHub actions where possible: https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services https://docs.github.com/en/actions/deployment/security-harde...
- rsanheim 5y agoGood to know - thanks!
- rndgermandude 5y ago>On a friday night no less. Not just any Friday, but Good Friday, which happens to be a legal holiday in many countries, including here in Germany. And since Easter Monday is one too, a lot of people will go on vacation on this "long" weekend (maybe even taking a couple of days off before or after to make it even longer)... Flights and hotel rooms booked, and all that.