Tenki’s startup program is live: up to $50K in credits and grants.Apply
Back to Blog

Security

Supply chain security, SLSA, OIDC, secrets management, policy as code, and hardening.

The validation tax - why reviewing AI-generated code is the real crisis facing engineering teams
Hayssem Vazquez-Elsayed
Hayssem Vazquez-Elsayed

The Validation Tax Is the Real AI Code Crisis

Security
5 min read
CI security focused on wrong layer - why teams are missing the critical attack surface in CI/CD pipelines
Hayssem Vazquez-Elsayed
Hayssem Vazquez-Elsayed

CI Security Is Focused on the Wrong Layer

Security
8 min read
OIDC keyless auth in GitHub Actions - secure AWS, GCP, and Azure access without stored credentials
Eddie Wang
Eddie Wang

OIDC Keyless Auth for AWS, GCP, and Azure in GitHub Actions

Security
9 min read
Security alert about Cordyceps exploit affecting over 300 repositories via pull_request_target
Eddie Wang
Eddie Wang

Cordyceps Exploits pull_request_target in 300+ Repos

Security
7 min read
Statistic showing 38% of GitHub Actions workflows are vulnerable to pwn request attacks
Eddie Wang
Eddie Wang

38% of Workflows Are Vulnerable to Pwn Requests

Security
8 min read
Security analysis of the Claude Code Action hijack incident and root cause breakdown
Hayssem Vazquez-Elsayed
Hayssem Vazquez-Elsayed

Claude Code Action Hijack: What Went Wrong

Security
9 min read
Illustration of prompt injection attacks targeting AI agents in GitHub Actions
Hayssem Vazquez-Elsayed
Hayssem Vazquez-Elsayed

AI Agent Prompt Injection in GitHub Actions

Security
11 min read
Security alert about the Miasma worm scraping CI runner memory to extract secrets
Eddie Wang
Eddie Wang

Miasma Worm Scraped CI Runner Memory for Secrets

Security
10 min read
Analysis of GitHub OIDC for Dependabot covering what it secures and what it doesn't
Eddie Wang
Eddie Wang

GitHub OIDC for Dependabot: What It Secures, What It Doesn't

Security
7 min read
Security alert about the Axios npm supply chain attack and CI/CD lockdown actions
Eddie Wang
Eddie Wang

Axios npm Supply Chain Attack: What CI/CD Teams Must Lock Down

Security
9 min read
Analysis of GitHub's internal repository breach and implications for CI trust boundaries
Hayssem Vazquez-Elsayed
Hayssem Vazquez-Elsayed

GitHub's Internal Repo Breach and Your CI Trust Boundary

Security
6 min read
GitHub MCP scanning launch - why your AI code review layer still matters for security and quality
Hayssem Vazquez-Elsayed
Hayssem Vazquez-Elsayed

GitHub MCP Scanning Is Here. Your Review Layer Still Matters.

Security
6 min read
GitHub and Microsoft Defender integration - linking code repositories to cloud security risk visibility
Eddie Wang
Eddie Wang

GitHub Connects Code to Cloud Risk via Defender

Security
6 min read
Illustration of prompt injection attacks targeting AI-powered GitHub Actions
Eddie Wang
Eddie Wang

Prompt Injection in AI-Powered GitHub Actions

Security
10 min read
Prompt injection attack - how a single PR comment hijacked three AI coding agents in a code review
Eddie Wang
Eddie Wang

The PR Comment That Hijacked Three AI Agents

Security
10 min read
OWASP AI Agent Security Top 10 audit guide for CI/CD pipelines
Eddie Wang
Eddie Wang

OWASP AI Agent Security Top 10: CI/CD Audit Guide

Security
11 min read
CI/CD pipeline policy as code - transitioning from YAML security configurations to centralized governance frameworks
Hayssem Vazquez-Elsayed
Hayssem Vazquez-Elsayed

CI/CD Policy as Code: From YAML Security to Centralized Governance

Security
10 min read
Illustration of a compromised security scanner, showing how a trusted code scanning tool can be exploited to introduce vulnerabilities, bypass detection, and impact software supply chain security.
Hayssem Vazquez-Elsayed
Hayssem Vazquez-Elsayed

When Your Security Scanner Gets Compromised

Security
10 min read
Illustration of GitHub Actions workflow lockfiles, showing how dependency locking improves CI/CD security, ensures reproducible builds, and prevents unauthorized changes.
Eddie Wang
Eddie Wang

GitHub Actions Workflow Lockfiles Are Coming

Security
8 min read
Overview of GitHub Actions artifact attestations, SLSA provenance, and supply chain security defaults
Hayssem Vazquez-Elsayed
Hayssem Vazquez-Elsayed

GitHub Actions Artifact Attestations: SLSA Provenance and Supply Chain Defaults

Security
11 min read
Guide on securing GitHub Actions by locking down GITHUB_TOKEN permissions
Hayssem Vazquez-Elsayed
Hayssem Vazquez-Elsayed

GitHub Actions Permissions: Lock Down GITHUB_TOKEN

Security
9 min read
Diagram showing GitHub Actions using OIDC with custom properties to enable attribute-based access control (ABAC) for secure cloud resource access.
Eddie Wang
Eddie Wang

GitHub Actions OIDC Custom Properties: ABAC Cloud Access

Security
8 min read