A potential supply chain attack on GitHub CodeQL started simply: a publicly exposed secret, valid for 1.022 seconds at a time. In that second, an attacker could take a series of steps that would allow them to execute code within a GitHub Actions workflow in most repositories using CodeQL, GitHub’s code analysis engine trusted by […]

The post CodeQLEAKED – Public Secrets Exposure Leads to Supply Chain Attack on GitHub CodeQL appeared first on Praetorian.

The post CodeQLEAKED – Public Secrets Exposure Leads to Supply Chain Attack on GitHub CodeQL appeared first on Security Boulevard.

Harry Hayward

Source: Security Boulevard
Source Link: https://securityboulevard.com/2025/03/codeqleaked-public-secrets-exposure-leads-to-supply-chain-attack-on-github-codeql/?utm_source=rss&utm_medium=rss&utm_campaign=codeqleaked-public-secrets-exposure-leads-to-supply-chain-attack-on-github-codeql