GF - Actions have consequences: The overlooked Security Risks in 3rd party GitHub Actions

Ground Floor, 14:30 Wednesday

After reviewing the build logs of public CI pipelines, I noticed security issues related to permissions and build integrity. To investigate the extent of the problem, I analyzed the build logs of the top 2,000 starred repositories on GitHub, and the results surprised even me. In this talk, I will share my findings on the prevalence of the world’s most popular repositories that fail to manage their build permissions. Such failure can lead to severe consequences, …

actions build consequences github github actions integrity logs party permissions pipelines problem public repositories results risks security security issues security risks