3 ms·
Article doesn't talk about much, just a bit on dependencies apparently from someone focused on supply chain security at Github. At previous role, the more we l
by kevin_nisbet 4y ago
Article doesn't talk about much, just a bit on dependencies apparently from someone focused on supply chain security at Github.
At previous role, the more we looked at some of the technical controls around security within github itself, and had a number of security concerns. There's alot of nuance which is hard to go through and comment on, but the defaults and controls caused us lots of concern.
Here's a good writeup for anyone interested: https://cycode.com/blog/github-actions-vulnerabilities/ https://cycode.com/blog/github-actions-vulnerabilities/
- jhutchings0 4y agoThanks for your comment! I'm Justin Hutchings, the author of that blog, and you're right that it was pretty narrowly focused on dependencies. We've been making a concerted effort to post about a number of security topics lately to provide best practices for users, everything from coordinated vulnerability disclosure, to how to protect from supply chain risks. You can find all of our security related blogs here: https://github.blog/category/security/ https://github.blog/category/security/ And thanks for sharing that blog, I'll pass it along to my colleagues in the Actions team.