Security advice often relies on unhelpful abstractions, but real-world incidents provide concrete, actionable guidance for developers.
The Codecov breach occurred when a secret in a Docker image led to a modified script that exfiltrated CI/CD environment variables.
Prevent secret leaks in Dockerfiles by using the `--secret` flag and always verify downloaded scripts with checksums or GPG signatures.
Storing secrets in environment variables makes them easy to exfiltrate, so prefer identity federation, secret managers, or temporary files instead.
A compromised dependency (`reviewdog`) was used to inject malicious code into the `changed-files` action, targeting Coinbase in a multi-stage attack.
Mitigate attacks by enforcing commit signing, restricting tag updates, and pinning GitHub Actions to a specific content digest.
Eliminate a common attack vector by replacing long-lived credentials with short-lived tokens generated via identity federation like OIDC.
A final recap covers key actions like verifying downloads, avoiding secrets in environment variables, pinning actions, and using short-lived credentials.
29:50Kevin Lewis
28:27Niels Tanis
25:28Joseph Katsioloudes
28:45Andrei Epure
32:55Natale Vinto
27:32Jasmin Azemović
21:53Isaac Evans
37:36Vandana Verma
.gif?w=240&auto=compress,format)
.png?w=240&auto=compress,format)
Jobs that call for the skills explored in this talk.
Computacenter AG & Co. OHG
NTT DATA Deutschland GmbH
NTT DATA Deutschland GmbH