Linux Foundation Decentralized Trust · Report #1548870
Unauthorized packages modification or secrets exfiltration via GitHub actions
Validstatus
highseverity
$1,500bounty
25upvotes
8 Jul 2022disclosed
Summary
Thank you to @dusty_wormwood for working closely with the Iroha team to fix this issue.
You can learn more about this vulnerability type at https://github.com/nikitastupin/pwnhub. Thanks to the Hyperledger team for thorough remediation and clear communication!
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.