Supply-chain vector in almost every codebase: unpinned GitHub Actions can change under you
andersonbcdefg · x · 2026-11-06
danlovesproofs reports a hack vector found in almost every customer codebase: GitHub Actions not pinned to specific versions. These third-party CI steps — listing changed files, Docker login, deploying to GitHub Pages — can have their behavior changed by their maintainers at any time, since they're not versioned under your own VCS. Many widely used actions are maintained by solo devs on personal accounts. andersonbcdefg adds he'll never use a GitHub Action.
More from coding & agent
- OpenClaw Ecosystem Hits 47 Products; Users Say Agents Outgrew the Chatbot Label — heyneighbor · 2026-11-06
- Full workflow: idea to finished AI video with Claude Code/Codex + Seedance, minimal re-rolls — dotey · 2026-11-06
- New vibe coder replicates Autodesk Maya in 3 hours with ChatGPT, asks for better workflow — Kiiaro · 2026-11-06
- Anthropic engineer confirms he's officially building Claude Code Desktop — maxleiter · 2026-11-06
- "Did your agents patch today's CVE?": dev shows agent running in the dark — aniketmaurya · 2026-11-06
- Dev fixes trivial bugs just to stop Claude nagging about them — jmugan · 2026-11-06