Yaron Avital

GitHub Repository Artifacts Leak Tokens

Analysis of how GitHub repository artifacts can inadvertently leak sensitive tokens and credentials, exposing organizations to security risks.

tj-actions GitHub Action Supply Chain Attack

In-depth research on supply chain vulnerabilities in GitHub Actions workflows and how attackers can exploit CI/CD pipelines.

Unpinnable Actions GitHub Security

Investigation into GitHub Actions that cannot be pinned to specific versions, creating potential security vulnerabilities.

GitHub Actions Opt-Out Permissions Model

Analysis of GitHub Actions permission models and the security implications of opt-out vs opt-in approaches.

Prevent Inadequate IAM GitHub Organization

Best practices and recommendations for securing GitHub organizations through proper Identity and Access Management.

A New Security Breach in GitHub Actions Threatens Software Giants

GeekTime coverage (Hebrew) of the ArtiPACKED vulnerability research, highlighting how this attack vector affects major companies like Canonical, Google, AWS, and Microsoft.

The Hacker News coverage of the ArtiPACKED

The Hacker News coverage of the ArtiPACKED vulnerability research, highlighting how this attack vector in GitHub Actions artifacts could allow malicious actors to steal tokens and gain unauthorized access to repositories.

Published: Aug 15, 2024

Bleeping Computer

Bleeping Computer coverage of the ArtiPACKED research, reporting how multiple high-profile open-source projects from Google, Microsoft, and AWS were inadvertently leaking GitHub authentication tokens through CI/CD workflow artifacts.

Published: Aug 14, 2024

CVE-2025-53097: Roo Code Workspace Security Vulnerability

Discovered and reported a security vulnerability in Roo Code agent's search_files tool that didn't respect workspace read limitations, potentially allowing unauthorized file access. CVSS Score: 7.5 (HIGH).

CVE Published: 2025

CICD Goat

A deliberately vulnerable CI/CD environment designed for learning and testing security vulnerabilities in CI/CD pipelines. This hands-on educational platform helps security professionals understand and practice identifying CI/CD security issues.