Codecov bash uploader marks five years, security risks persist in pipelines

Every CI job is a small, under-supervised computer with your production secrets in its environment and root inside its container. (Comforting, isn't it?) The New Stack revisited that fact this week with an anatomy of the Codecov breach: the January 2021 incident in which an attacker added a single l