News for hackers. Stuff that matters.

A comment on How We Exploited CodeRabbit: From Simple PR to RCE and Write Access on 1M Repos. Parent comment

Re:How We Exploited CodeRabbit: From Simple PR to RCE and Wr... by cleverwebb on Tuesday August 19, 2025 @02:03PM (#44954399)
how do you know that no customer data was affected? did you work with github and scan all uses of your keys? how do you know if a use of your github key was authentic or not? did you check with anthroipic/openai/etc to scan logs usage?

It's really hard to trust a "hey we got this guys" statement after a fuckup this big

[ Parent | on HN ]
Re:How We Exploited CodeRabbit: From Simple PR to RCE and Wr... by Xunjin on Tuesday August 19, 2025 @02:54PM (#44954937)
That's why countries should start to legislate on these matters, there are no incentives in focusing on security and properly report to the customers such vulnerability.
[ Parent | on HN ]
Re:How We Exploited CodeRabbit: From Simple PR to RCE and Wr... by xign on Tuesday August 26, 2025 @03:53PM (#45031506)
Notice how replies like this never get a response?
[ Parent | on HN ]