Blog

Authors

Noam Dotan

Noam Dotan

Showing all posts by Noam Dotan

Legit

OpenSSF SCM Best Practices Guide Released With Contributions From Legitify

Explore the collaborative effort by OpenSSF and leading security vendors in the release of SCM Best Practices Guide.

Legit Security | Legit Security's ASPM platform offers an enterprise-grade ASPM solution, proven by customers.

AppSec Legit Partners

Legit Security and CrowdStrike: Securing Applications from Code Creation to Cloud Deployment

Legit Security's ASPM platform offers an enterprise-grade ASPM solution, proven by customers.

Legit Security | This blog shows another case of GitHub Actions environment injection vulnerability in a Google repository.

Legit Threats

How We Found Another GitHub Actions Environment Injection Vulnerability in a Google Project

This blog shows another case of GitHub Actions environment injection vulnerability in a Google repository.

New software supply chain vulnerabilities use artifact poisoning and attack the software development pipelines on projects using GitHub Actions.

Threats SCMs

Novel Pipeline Vulnerability Discovered; Rust Found Vulnerable

New software supply chain vulnerabilities use artifact poisoning and attack the software development pipelines on projects using GitHub Actions.

GitHub configurations aren't secure out of the box. It's up to you to secure them. This blog discusses GitHub's new Codespaces product and how to secure it.

Best Practices SCMs

GitHub Codespaces Security Best Practices

GitHub configurations aren't secure out of the box. It's up to you to secure them. This blog discusses GitHub's new Codespaces product and how to secure it.

GitHub’s required reviewers capability can be bypassed if currently using this setting to require at least one code review before merging code.

Threats SCMs

Attackers Can Bypass GitHub Required Reviewers to Submit Malicious Code

GitHub’s required reviewers capability can be bypassed if currently using this setting to require at least one code review before merging code.

Learn how Legit Security discovered a vulnerable GitHub actions workflow that affected Google, Apache and potentially many more. Get details on the vulnerability and what you can do to mitigate it.

Legit Threats SCMs

Google & Apache Found Vulnerable to GitHub Environment Injection

Learn how Legit Security discovered a vulnerable GitHub actions workflow that affected Google, Apache and potentially many more. Get details on the vulnerability and what you can do to mitigate it.

LastPass disclosed that an unauthorized party had gained access to portions of the LastPass developer environment. An attacker gained access to developer account credentials and used them to exfiltrate portions of their proprietary source code.

Best Practices Threats

LastPass Software Supply Chain Attack: What Happened and Tips to Protect Against Similar Attacks

LastPass disclosed that an unauthorized party had gained access to portions of the LastPass developer environment. An attacker gained access to developer account credentials and used them to exfiltrate portions of their proprietary source code.

We examine a bug we’ve found in a popular third-party GitHub action and how it could lead to your SDLC pipeline being attacked. Read more to improve GitHub security and secure your software supply chain.

Best Practices Legit Threats SCMs

Vulnerable GitHub Actions Workflows Part 2: Actions That Open the Door to CI/CD Pipeline Attacks

We examine a bug we’ve found in a popular third-party GitHub action and how it could lead to your SDLC pipeline being attacked. Read more to improve GitHub security and secure your software supply chain.

Learn how Legit Security discovered a vulnerable GitHub actions workflow. Get details on the vulnerability and and what you can do to mitigate it.