Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by Noam Dotan
How to Mitigate the Risk of GitHub Actions
Get highlights of our research into the security of GitHub Actions, and our advice on mitigating the risk. We recently published a report, called The State of GitHub Actions Security , which analyzes the security posture of GitHub Actions workflows and custom GitHub Actions. This report is based on an analysis of 2,500,000 GitHub Actions workflow files belonging to 553,000 organizations and personal users.
Security of GH Workflows Building Blocks
Understand the security status of GitHub Actions workflows and how to mitigate the risk. We recently published a report, called The State of GitHub Actions Security, which analyzes the security posture of GitHub Actions workflows and custom GitHub Actions. This report is based on an analysis of 2,500,000 GitHub Actions workflow files belonging to 553,000 organizations and personal users. Some notable findings include the insecurity of the building blocks of GitHub Actions workflows.
Security of Custom GitHub Actions
Get details on Legit's research on the security of custom GitHub Actions. We recently published a report, called The State of GitHub Actions Security , which analyzes the security posture of GitHub Actions workflows and custom GitHub Actions. This report is based on an analysis of 2,500,000 GitHub Actions workflow files belonging to 553,000 organizations and personal users.
Using AI to Reduce False Positives in Secrets Scanners
Get an overview of how secrets scanners work, and how Legit is dramatically reducing secret-scanning false positives. As development environments grow more complex, applications increasingly communicate with many external services. When a software development project communicates with an external service, it utilizes a token or "secret" for authentication. These tokens are the glue that keeps any modern application together, and there is a staggering volume and variety of them in code today.
Using AI to reduce false positives in secrets scanners
By signing up for our newsletter, you agree to our Terms of Use and Privacy Policy
GenAI-Based Application Security 101
Gain insights into GenAI applications and how they represent an innovative category of technology, leveraging Large Language Models (LLMs) at their core. Introduction GenAI applications represent an innovative category of technology, leveraging Large Language Models (LLMs) at their core to implement new types of applications, such as autonomous agents, or to revolutionize old ones, such as chatbots.
OpenSSF SCM Best Practices Guide Released With Contributions From Legitify
We're thrilled to share that the OpenSSF SCM Best Practices working group has released its SCM Best Practices Guide. This guide is the result of collaborative efforts between Legit Security and several of the industry's top security vendors under the OpenSSF banner to bring this guide to life. The guide addresses the important task of securing Source Code Management (SCM) platforms. The goal is to promote safer, more resilient development environments, keeping vulnerabilities at bay.
Securing Applications from Code Creation to Cloud Deployment
Cloud environments and the applications running on them present an enormous attack surface that's frequently exploited. Protecting runtime environments in the cloud is certainly a top concern for any CISO, but solutions that detect and mitigate vulnerabilities in the cloud also bring operational challenges, noise, and remediation obstacles that can hinder an effective and efficient security program.
How We Found Another GitHub Action Environment Injection Vulnerability in a Google Project
It downloads an artifact that it expects to be previously uploaded by the "checks" workflow It then reads the pull-request number from artifact and writes it into the 'pr_number' environment variable Where is the problem The uploaded artifact is controlled by a potentially malicious actor. This means an adversary could trick the privileged "report-checks" workflow to write malicious content into the GITHUB_ENV file.
Noam Dotan
By Noam Dotan When GitHub released Codespaces last year it was touted as their best release since GitHub Actions. If you're using Codespaces or thinking about it, make sure you understand the security risks involved. When Codespaces is implemented without following the best practices below, your software supply chain will be at increased ... Read More
How to Secure GitHub/GitLab Servers with Legitify
Legitify is an open source security tool from Legit Security that scans server configuration monitor (SCM) servers and detects security misconfigurations. It also provides detailed remediation steps and integration with GitHub Actions to use within continuous integration (CI) processes. As more and more attacks target weakly configured and vulnerable SCMs, organizations should take special care to ensure they are protected.
Novel Pipeline Vulnerability Discovered; Rust Found Vulnerable
The Legit Security Research Team discovered a new class of software supply chain vulnerabilities that leverages artifact poisoning and attacks the underlying software development pipelines for projects using GitHub Actions. In this fourth blog covering vulnerable GitHub Actions, we will explore this new technique of artifact poisoning and describe who could be vulnerable, including how we found this vulnerability in the Rust programming language and assisted in its remediation.
Top Software Supply Chain Security Solution Approaches: Pros and Cons
What are different solution approaches to software supply chain security and what are the Pros and Cons for your organization? What is the modern definition of software supply chain security and why is it so important, now more than ever, to increase your focus on this aspect of cybersecurity? This blog will answer those questions and provide guidance to help support your decision to implement a solution. What Is a “Software Supply Chain”?
Novel Pipeline Vulnerability Discovered; Rust Found Vulnerable
The Legit Security Research Team discovered a new class of software supply chain vulnerabilities that leverages artifact poisoning and attacks the underlying software development pipelines for projects using GitHub Actions. In this fourth blog covering vulnerable GitHub Actions, we will explore this new technique of artifact poisoning and describe who could be vulnerable, including how we found this vulnerability in the Rust programming language and assisted in its remediation.
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with Noam
Contact Noam, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack