Noam Dotan

GitHub Codespaces Security Best Practices

Noam Dotan : Sep 28, 2022 1:37:33 PM

When GitHub released Codespaces last year it was touted as their best release since GitHub Actions. If you’re using Codespaces or thinking about it,...

Attackers Can Bypass GitHub Required Reviewers to Submit Malicious Code

Noam Dotan : Sep 8, 2022 11:47:40 AM

Update: a few weeks after this publication, GitHub decided to fix the issue and employed the mitigation we recommended to them in our initial report....

Google & Apache Found Vulnerable to GitHub Environment Injection

Noam Dotan : Sep 1, 2022 10:00:03 AM

In this blog post, we'll discuss a new type of GitHub Actions workflow vulnerability we called "GitHub Environment Injection". We've found a couple of

1 min read

LastPass Software Supply Chain Attack: What Happened and Tips to Protect Against Similar Attacks

Noam Dotan : Aug 29, 2022 9:17:15 PM

LastPass, one of the world's largest password managers with 25 million users, disclosed that an unauthorized party had gained access to portions of...

Vulnerable GitHub Actions Workflows Part 2: Actions That Open the Door to CI/CD Pipeline Attacks

Noam Dotan : May 2, 2022 10:44:09 AM

In this blog post, we’ll explore a bug we’ve found in a popular third-party action and how in some cases it could lead to your SDLC pipeline being...

Vulnerable GitHub Actions Workflows Part 1: Privilege Escalation Inside Your CI/CD Pipeline

Noam Dotan : Apr 4, 2022 3:01:54 PM

At Legit Security, we’re focused on preventing software supply chain attacks and securing the SDLC for our customers and the broader cybersecurity...