News for hackers. Stuff that matters.

A comment on GitHub Actions update: Helping maintainers combat bad actors. Parent comment

Re:GitHub Actions update: Helping maintainers combat bad actors by mhils on Friday April 23, 2021 @07:19AM (#26913503)
> In the next commit the PR author exfiltrates GitHub secrets by base64ing them and logging in the workflow run (or any other way).

Environment secrets are not exposed to PRs, so this does not work. This really only concerns DoS.

[ Parent | on HN ]
Re:GitHub Actions update: Helping maintainers combat bad actors by hashhar on Monday April 26, 2021 @01:49AM (#26939602)
IIRC I can look at the secret names in the workflow definition then pipe them through `base64 | zip` and have fun.

I did this quite some time ago but they may have added better limits in place.

[ Parent | on HN ]