Sebastion
←All topics

ci-cd

5 pieces of writing

security10 min read

Trivy turned a security scanner into a credential stealer

The Trivy compromise showed why CI/CD security tools are high-value supply chain targets: they run where secrets, tokens and publishing credentials already live.

security13 min read

May 2026 developer-tooling compromises: VS Code extensions, PyPI packages and GitHub Actions turned workstations into supply-chain targets

GitHub Actions OIDC and TanStack show why 2026 supply chain attacks target release authority
security11 min read

GitHub Actions OIDC and TanStack show why 2026 supply chain attacks target release authority

From tj-actions to LiteLLM to MCP: supply chain compromise now operates at infrastructure scale
security9 min read

From tj-actions to LiteLLM to MCP: supply chain compromise now operates at infrastructure scale

Eighteen months of supply chain attacks against AI infrastructure reveal a structural pattern: the build pipeline, the package registry and the runtime protocol all share the same trust model failure.

When a GitHub Action rewrites its own history
security6 min read

When a GitHub Action rewrites its own history