Auditing GitHub Issue Automation After a 61-Repo Supply-Chain Campaign

GitHub issues are an input channel for CI automation. This short walks through the 61-repo issue campaign, why issue text can become shell input, and a defensive audit path: check workflow token permissions, trace issue fields to sinks, and gate write steps with reviewers. Read the full audit: https://hackyjs.com/posts/auditing-github-issue-automation-after-a-61-repo-supply-chain-campaign

Read the post →