🕵️‍♂️ Security risks in GitHub Actions (by Igor Stepansky) | Cloud & CI/CD Security TechSpot

Igor Stepansky shows how attackers abuse GitHub Actions and what you can realistically do about it. 🧠 𝐓𝐡𝐢𝐬 𝐭𝐚𝐥𝐤 𝐬𝐡𝐨𝐰𝐬: • Structure of GitHub Actions workflows: triggers, jobs, runners, steps, actions • Main risk areas: secrets, GitHub token permissions, missing dependency pinning, third-party actions, etc. • Real incidents: tj-actions supply-chain compromise, PyTorch contributor → runner takeover → malicious release • Hardening practices that work in day-to-day engineering • Open-source tool demo: mapping and scanning the full action chain 🎤 𝐒𝐩𝐞𝐚𝐤𝐞𝐫: Igor Stepansky, Security Researcher at Orca Security https://www.linkedin.com/in/igor-stepansky/ 👇 𝐓𝐢𝐦𝐞𝐬𝐭𝐚𝐦𝐩𝐬: 0:00 – Intro and speaker background 1:30 – Agenda and why GitHub Actions matters (CI/CD adoption) 2:40 – How GitHub Actions works: workflows, jobs, runners, marketplace actions 7:24 – Eight common security risks in GitHub Actions (overview) 7:51 – Secret management and GITHUB_TOKEN permission issues 10:23 – Dependency pinning failures and supply-chain attacks via actions 12:32 – Code injection, artifact poisoning, and dangerous triggers (pull_request_target) 16:44 – Self-hosted runners and real-world attacks (tj-actions, PyTorch) 23:05 – Hardening checklist and secure GitHub Actions practices 25:40 – Aspect (ex-Actchain): scanning the full GitHub Actions chain 29:10 – “Homework”: OWASP CI/CD Top 10 and deeper talks on Actions attacks 30:06 – Q&A: AI in security tooling, noisy findings, and parallel use with classic tools 32:15 – Q&A: pinning vs. latest, trusting hosted runners, and small-company trade-offs 36:09 – Q&A: tooling cost, open source options, forks, secrets, and identity federation 👀 𝐎𝐭𝐡𝐞𝐫 𝐭𝐚𝐥𝐤𝐬 𝐟𝐫𝐨𝐦 𝐭𝐡𝐞 𝐂𝐥𝐨𝐮𝐝 & 𝐂𝐈/𝐂𝐃 𝐒𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐓𝐞𝐜𝐡𝐒𝐩𝐨𝐭: Panel discussion https://youtu.be/Da9fL9LaeUs Talk https://youtu.be/XSO-A9K51ZU 🌟 TechSpot events are driven by On The Spot Development. More about TechSpot: https://onthespotdev.com/techspot Open positions for engineers in Poland: https://onthespotdev.com/careers #devsecops #githubactions #cicd #supplychainsecurity #cybersecurity #opensourcesecurity