4 ms·
Also you can leak any secrets by making connections to external services via internet and simply send secrets to them.
by qbane 1y ago
Also you can leak any secrets by making connections to external services via internet and simply send secrets to them.
- formerly_proven 1y agoNot in many enterprisey CI systems you can't, those frequently have hermetic build environments.
- msgodel 1y agoNothing makes me want to quit software more than enterprisey CI systems.
- qbane 1y agoI think GitHub is correct that the bypass itself is not a vulnerability, but just like the little tooltip on GitHub's "create secret gist" button, GitHub can do a better job clarifying at the "Actions permissions" section.
- mystifyingpoi 1y agoYou can also print them to console in quadruple base64 in reverse, the trick is getting away with it.