Post #3642003
2026-07-07 06:09 UTC
The core of the problem trickles down to weak CI/CD configurations that grant pull requests (PRs) more permissions than they should have.
How exactly do their competitors like codeberg do better in preventing that?
Replies (2)
-
@onlinepersona@programming.dev 2026-07-07 07:19
The article doesn’t seem to say. I don’t know if it’s a problem with defaults or caused by the devs themselves.
-
@A_norny_mousse@piefed.zip 2026-07-07 16:10
I’m no expert in this but I’m guessing GH’s higher tiers provide much more “actions” and whatnot than Codeberg does. AFAICS Gitlab might be the only alternative that even has the mechanisms that could be exploited. But executing code in a comment, that’s harsh in any case. I mean, even I would’ve known how to prevent that right from the start. I think.