Auditing GitHub Actions for CI Secret Theft: OIDC Migration Lessons from 4,837 Compromised Accounts

A short defensive audit of GitHub Actions credential exposure: pull_request_target plus head checkout, branch-triggered workflow_dispatch with id-token write, and OIDC migration fixes. Full write-up: https://hackyjs.com/posts/auditing-github-actions-for-ci-secret-theft-oidc-migration-lessons-from-4837-compromised-accounts

Read the post →