GitHub - Finatext/gha-fix: Automates security and maintenance fixes in GitHub Actions workflowsYou signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session. You switched accounts on another tab or window. Reload to refresh your session. Dismiss alert
GitHub - AdnaneKhan/gato-x: GitHub Attack Toolkit - Extreme Edition - A static analysis and exploit toolkit for GitHub Actions.
Gato-X is a FAST scanning and attack tool for GitHub Actions pipelines. You can use it to identify Pwn Requests, Actions Injection, TOCTOU Vulnerabilities, and Self-Hosted Runner takeover at scale using just a single API token. It will also analyze cross-repository workflows and reusable actions. This surfaces vulnerabilities that other scanners miss because they only scan workflows within a singl
Defeating Prompt Injections by Design
Large Language Models (LLMs) are increasingly deployed in agentic systems that interact with an untrusted environment. However, LLM agents are vulnerable to prompt injection attacks when handling untrusted data. In this paper we propose CaMeL, a robust defense that creates a protective system layer around the LLM, securing it even when underlying models are susceptible to attacks. To operate, CaMe
Deployment Considerations for Windows ZTDNS Client | Microsoft Community Hub
This document goes over what considerations administrators should keep in mind when evaluating how ZTDNS fits into their Zero Trust deployment model. For more information about what ZTDNS is, see this feature announcement. Zero Trust DNS (ZTDNS) is a powerful Windows feature that enables an administrator to lock down Windows outbound IP-based traffic to endpoints approved by a Protective DNS servi
Fighting cookie theft using device bound sessions
Cookies – small files created by sites you visit – are fundamental to the modern web. They make your online experience easier by saving browsing information, so that sites can do things like keep you signed in and remember your site preferences. Due to their powerful utility, cookies are also a lucrative target for attackers. Many users across the web are victimized by cookie theft malware that gi
CSPでサードパーティースクリプトを律する
はじめに Legalscapeの顧客の中には、情報セキュリティー等の理由から社内ネットワークからの通信の宛先を制限している組織もたくさんいます。 そのためLegalscapeでは、プロダクトの動作に必要な第三者リソースの一覧を管理し、Legalscapeの導入時にはそれらのドメイン名への接続を許可するようにお願いしてきました。 しかし、現代のWeb開発は、第三者リソースが利用可能であることを暗に期待しがちです。開発者がLegalscapeの顧客背景をよく知らずに新しい依存を導入してしまうことも考えられます。またさらに厄介なのが間接依存の増加です。実際に、firebase packageの更新によって内部で呼び出しているAPIのエンドポイントが変化し、開発者が知らないうちに接続先が変わっていたということが判明しています。[1] そこで私は、CSPを使うことでサードパーティースクリプトやAPI
1
Improving the security of Chrome cookies on Windows
Black Hat GraphQL
Japan Blames North Korea for PyPI Supply Chain Cyberattack
Lessons On Secrets Security From Datadog Research
Node.js — Wednesday February 14 2024 Security Releases
