cleverwebb
Re:How We Exploited CodeRabbit: From Simple PR to RCE and Write Access...
on Tuesday August 19, 2025 @02:03PM (#44954399)
how do you know that no customer data was affected? did you work with github and scan all uses of your keys? how do you know if a use of your github key was authentic or not? did you check with anthroipic/openai/etc to scan logs usage?
It's really hard to trust a "hey we got this guys" statement after a fuckup this big
Re:How We Exploited CodeRabbit: From Simple PR to RCE and Write Access...
on Tuesday August 19, 2025 @01:58PM (#44954351)
I had a visceral and (quite audible) reaction when I got to the environment variable listing.