GitHub Actions: a time bomb for supply chain security
summary
GitHub Actions are widely used for CI/CD but are insecure by default; the talk analyzes 2025 supply-chain attacks (tj-actions, s1ngularity, GhostAction, Shai-Hulud) that exfiltrated secrets and explains why GitHub’s current security model is inadequate. It presents concrete defenses: scoped secrets with approval rules, minimal GITHUB_TOKEN permissions, egress controls, hardening runners, and runtime protection tools.
AI-written summary · about
chapters (6)
- 0:00GitHub Actions security
- 1:49Recent supply chain attacks
- 6:08GitHub Actions attack vector
- 9:21Why GitHub Actions is insecure
- 11:52GitHub responses and best practices
- 14:00Conclusion
related talks
42mProtecting Your GitHub from Supply Chain Attacks
56mHow to use GitHub Actions with Security in mind
55mBeyond the Commit: Weaponizing and Hardening GitHub Actions
23mBreaking the Build: How Attackers Abuse GitHub Actions
42mProtecting CI/CD from malicious deploys
45mGitHub Actions & Security
52mGitHub Actions Security: From CI Nightmare to Supply Chain Sentinel
51mHow to secure your GitHub Actions