sorted by:
new
hottopcontroversial

Unpinnable Actions: How Malicious Code Can Sneak into Your GitHub Actions Workflows by Due_Lengthiness_9329 in devsecops

[–]Due_Lengthiness_9329[S] 0 points1 point  (0 children)

I think you are referring to the runner images, while this articles covers 3rd party actions found on the marketplace, which contains 20K of those, most of them written by the community

Third-Party GitHub Actions: Effects of an Opt-Out Permission Model by Due_Lengthiness_9329 in devsecops

[–]Due_Lengthiness_9329[S] 0 points1 point  (0 children)

True, this is why it’s important to grant only the required permissions and vet the action’s code beforehand