How We Exploited CodeRabbit: From Simple PR to RCE and Write Access on 1M Repos

Re:How We Exploited CodeRabbit: From Simple PR to RCE and Wr... by cleverwebb on Tuesday August 19, 2025 @01:58PM (#44954351)

I had a visceral and (quite audible) reaction when I got to the environment variable listing.

[ Parent | on HN ]

Re:How We Exploited CodeRabbit: From Simple PR to RCE and Wr... by curuinor on Tuesday August 19, 2025 @02:27PM (#44954659)

hey, this is Howon from CodeRabbit. We use a cloud-provider-provided key vault for application secrets, including GH private key.

[ Parent | on HN ]

Re:How We Exploited CodeRabbit: From Simple PR to RCE and Wr... by hotsauceror on Tuesday August 19, 2025 @03:49PM (#44955589)

This is the third or fourth time you’ve spammed this exact comment in response to people’s perfectly legitimate questions. What is this clown-show bullshit?

[ Parent | on HN ]

Re:How We Exploited CodeRabbit: From Simple PR to RCE and Wr... by tnolet on Tuesday August 19, 2025 @02:35PM (#44954745)

what does that mean? Were the leaked keys irrelevant?

[ Parent | on HN ]