Post · March 29, 2026
GitHub Actions Best Practices: Securing Your CI/CD Pipeline
Harden your CI/CD pipeline. This guide covers GitHub Actions cybersecurity best practices, from scoping permissions to managing secrets and secure triggers.
Read →Tag Archive
DevSecOps
Archive for this tag.
Posts
-
-
Post · March 13, 2026
From Fork to RCE: Deconstructing the Orca Security GitHub Actions Exploit
A step-by-step breakdown of the 'Pull Request Nightmare' exploit. See how attackers leverage `pull_request_target` to achieve RCE and steal secrets.
Read → -
Post · February 25, 2026
Why Is pull_request_target So Dangerous? A Security Explainer
The `pull_request_target` trigger in GitHub Actions is a major security risk if misused. Understand why it's dangerous and how it exposes repository secrets.
Read → -
Post · February 09, 2026
3 Ways to Secure Your GitHub Workflows from Malicious Pull Requests
Secure your GitHub Actions. Learn 3 essential mitigation techniques: checking PR origins, using manual approval labels, and gating jobs with environments.
Read → -
Post · January 24, 2026
Am I Vulnerable? How to Audit Your GitHub Actions for the pull_request_target Flaw
Audit your GitHub workflows for a critical security flaw. This guide helps you identify if your use of `pull_request_target` is checking out untrusted code.
Read → -
Post · January 08, 2026
The 'Pull Request Nightmare': How RCE Was Found in Google & Microsoft Repos
Explore the `pull_request_target` vulnerability found by Orca Security. See how Fortune-100 companies were exposed to RCE from a single malicious pull request.
Read → -
Post · December 23, 2025
pull_request vs. pull_request_target: The GitHub Actions Trigger Hiding a Security Nightmare
Learn the security-critical distinction between `pull_request` and `pull_request_target` in GitHub Actions. One is safe for forks, the other could expose your secrets and code.
Read → -
Post · December 01, 2025
Career Pivot: From Software Engineer to Security-Minded Software Architect
Unlock your next career stage by leveraging Blue Team workshop experience to enhance architectural security, operational monitoring, and compliance processes.
Read → -
Post · October 27, 2025
Red Team vs Blue Team: Cybersecurity Essentials for Future Software Architects
Discover how Blue Team cybersecurity expertise shapes resilient, observable, and secure system architectures, and why it's a strategic advantage for software engineers becoming architects.
Read →