News for hackers. Stuff that matters.

A comment on Codecov breach impacts GoDaddy, Atlassian, P&G etc.. Parent comment

Re:Codecov breach impacts GoDaddy, Atlassian, P&G etc. by lloeki on Sunday April 18, 2021 @10:58AM (#26853038)
The design is that such tests would be run in PR non-protected branches and thus reviewed before being merged into protected branches for later deployment; that, we agree as much.

I guess the protected branch segregation should go -both ways- and more effort should be made into auditing and vetting which CI step has run access to secret-authorised branches.

[ Parent | on HN ]
Re:Codecov breach impacts GoDaddy, Atlassian, P&G etc. by CameronNemo on Sunday April 18, 2021 @07:35PM (#26857630)
Protected secrets has always seemed like such a rough barrier. No fine tuning at all (e.g. if you have stage and prod creds that you want to be kept separate, but both "protected"... No good way to do that from my POV).
[ Parent | on HN ]