Tag

#github-actions

Analysis

Keys Are Pointers Too: GitHub Actions Cache Poisoning

The build cache is mutable resolution between runs: how a low-privilege context poisons a cache a privileged workflow restores.

Daniel Malvaceda · Jun 20, 2026 · 18 min read

Analysis

The structural gap between what a pipeline declares and what it executes, and what hash pinning actually fixes.

Daniel Malvaceda · Apr 16, 2026 · 14 min read

Incident Critical GitHub Actions docker-hub

How a two-minute GitHub PR gave TeamPCP 18 days of silent access to Trivy's CI: Pwn Request, non-atomic rotation, and 82 poisoned Actions tags.

Daniel Malvaceda · Mar 27, 2026 · 21 min read