Introducing Raven: CI/CD Pipeline Security with Open Source Vulnerability Scanner Starting with GitHub Actions
Cycode is proud to announce the public release of Raven…
Research
Shadow Tokens: Persistence Under The Radar
Exposed credentials are one of the most abused methods for gaining initial access…
VS Code’s Token Security: Keeping Your Secrets… Not So Secretly
This is the full story of the vulnerability we have discovered within Visual Studio Code (VS Code) concerning the handling of secure token storage. While designed for isolated storage for each extension, this vulnerability presents…
Security Advisory: GitLab Malicious Runner Vulnerability
GitLab, has recently patched a critical vulnerability that allows attackers to attach malicious runners…
Enhancing CI/CD Pipeline Security with OIDC Tokens for Cloud Authentication
As the demand for faster and more efficient application deployment grows, the use of pipelines…
From Default to Secure: Analyzing the Vulnerability that Could Have Compromised Microsoft 365 Users
As part of our ongoing research in the open-source ecosystem, Cycode Labs has found and disclosed a novel attack…
Cycode Discovers a Vulnerability in GitHub API Authorization – CVE-2022-46258
Cycode Labs discovered a vulnerability in Github’s API in which GitHub Actions workflows …
Cycode Collaborates with CodeSee to Secure the Pipelines of Thousands of Open-Source Projects
Securing open-source projects is hard. Securing CI workflows…
CI-Story: How We Found Critical Vulnerabilities in StoryBook Project
Cycode found several vulnerabilities in its GitHub Actions development pipeline that may have allowed any user on the internet to run arbitrary code …
All Roads Lead to Build Secrets – Or How Your Build System Could Expose The Production Environment
Every software manufacturer nowadays implements robust DevOps processes to increase its ability to deliver applications and services at high velocity. These processes usually include testing, building, packaging, deploying, and additional autonomous procedures. This article will demonstrate that the race to embrace CI/CD capabilities has introduced subtle new risks. An especially significant risk that most organizations … Read more