Tag

#secrets

Tagged “secrets”

11 articles

GhostAction used about 1,900 stolen GitHub logins to plant secret-stealing workflows in 30,000 repos

Attackers used roughly 1,900 compromised GitHub accounts to add credential-stealing GitHub Actions workflows to more than 30,000 repositories. No flaw in Actions was involved, so the fixes are token hygiene, review of workflow changes and rotating every secret those jobs could reach.

Oct 27, 2026 · Maya Okonkwo Security & supply chain

Vercel wants static credentials gone. Its own GitHub Actions deploy still needs one

Vercel is giving Marketplace vendors until January 2027 to replace long-lived API keys with OIDC and short-lived tokens or risk being delisted. Developers point out that Vercel's own GitHub Actions deployment guide still authenticates with a persistent VERCEL_TOKEN secret.

Oct 24, 2026 · Tomás Vega Cloud security

Google Cloud spells out its abuse-response ladder: throttle, isolate, suspend

A Google Cloud security-team post consolidates how the platform reacts when a tenant workload starts leaking credentials, mining crypto, or burning a stolen API key. For pipeline owners the operational read is the escalation path, and how easily a shared project can end up on it.

Aug 8, 2026 · Maya Okonkwo Security & supply chain

Docker Hub gets OIDC federation for GitHub Actions, retiring the PAT-in-a-secret pattern

Docker has added OpenID Connect authentication for GitHub Actions on Team, Business and Docker Hardened Images plans, so workflows push and pull images with a short-lived per-run token instead of a stored Personal Access Token. It closes off one of the last static credentials still sitting in most Actions repos.

Aug 1, 2026 · Maya Okonkwo Security & supply chain

GitHub starts watching the whole public site for your leaked secrets

GitHub is previewing public monitoring for enterprise secret scanning: real-time detection across all of public github.com, with leaks attributed back to your organisation. Useful, and a preview, so read the small print.

Jul 6, 2026 · Tomás Vega Security & supply chain

Copilot CLI drops the PAT requirement inside GitHub Actions

GitHub says Copilot CLI, when invoked from a GitHub Actions workflow, will now accept the built-in GITHUB_TOKEN. That retires one of the last long-lived personal tokens teams were carrying just to script Copilot from CI.

Jul 4, 2026 · Maya Okonkwo Incident response

HCP Vault Dedicated opens cluster DR drills, by support ticket only

HashiCorp put cluster disaster recovery for HCP Vault Dedicated into public preview, giving teams a way to simulate cluster-level failures and prove their failover path. The drill is gated through HashiCorp support, not the customer's own runbook.

Jun 28, 2026 · Maya Okonkwo Security & supply chain

Vault wants your AI agents to ask permission, one request at a time

HashiCorp Vault Enterprise has put a new authorization model for AI agents into public preview, built on OAuth 2.0 Rich Authorization Requests so agents must declare what they want on every call instead of inheriting long-lived secrets. For pipelines that now host coding agents, it changes who is allowed to do what at runtime.

Jun 27, 2026 · Tomás Vega Security & supply chain

Dependabot can finally pull from private GitHub Packages without a PAT

GitHub gave Dependabot its own GITHUB_TOKEN access to private GitHub Packages and GHCR, retiring one of the most awkward credentials in any CI setup. For pipeline owners, that closes a quiet but persistent rotation tax.

Jun 24, 2026 · Priya Nair Security & supply chain

Vault learns to speak SPIFFE, and your pipeline's static token is on notice

HashiCorp wired SPIFFE into Vault as both an auth method and a secrets engine, positioning Vault as a workload-identity broker that sits next to SPIRE rather than replacing it. For CI/CD that means one more reason the long-lived bearer token in your job secrets is harder to defend by the day.

Jun 17, 2026 · Tomás Vega Security & supply chain

GitHub Agentic Workflows drop personal access tokens for the built-in Actions token

Agentic workflows on GitHub can now authenticate with the ephemeral GITHUB_TOKEN instead of a long-lived personal access token. It is a quiet credential-hygiene win that closes one of the messier blast radii in agent-driven CI.

Jun 15, 2026 · Tomás Vega