Your CI ran code it should not have, and you cannot prove it did not

A few weeks ago someone force-pushed 75 of 76 version tags in aquasecurity/trivy-action. Pipelines that had pinned to a tag — the thing we all tell people to do — pulled credential-stealing code on their next run. It read /proc//environ and sent secrets to a typosquat domain. A few days later, two l

Related Stories

The attack that hijacked Claude Code came through Sentry. Datadog, PagerDuty, and Jira have the same exposure.

📰

Your AI agent's leak risk depends more on the model than the prompt

📰

Seamless Remote Server Access: A New Era of Contractor-Approved Server Restart

Beware of Cloud Waste: The Invisible Overhead of Vanity Deployments