News for hackers. Stuff that matters.

A comment on How We Exploited CodeRabbit: From Simple PR to RCE and Write Access on 1M Repos. Parent comment

Re:How We Exploited CodeRabbit: From Simple PR to RCE and Wr... by tadfisher on Tuesday August 19, 2025 @01:55PM (#44954318)
But do you still store your GH API private key in environment variables?
[ Parent | on HN ]
Re:How We Exploited CodeRabbit: From Simple PR to RCE and Wr... by curuinor on Tuesday August 19, 2025 @02:26PM (#44954651)
hey, this is Howon from CodeRabbit. We use a cloud-provider-provided key vault for application secrets, including GH private key.
[ Parent | on HN ]
Re:How We Exploited CodeRabbit: From Simple PR to RCE and Wr... by musicnarcoman on Tuesday August 19, 2025 @03:28PM (#44955337)
So the CodeRabbit application with access to application secrets still runs in the same virtual machine as untrusted code from the outside?
[ Parent | on HN ]
Re:How We Exploited CodeRabbit: From Simple PR to RCE and Wr... by megamorf on Wednesday August 20, 2025 @04:29AM (#44959906)
Howon, you can stop posting that canned response. It's not helping the discussion in any way and matches the lack of detail the other commenters have pointed out.
[ Parent | on HN ]