How the Trivy supply chain attack harvested credentials from secrets managers

vaultproof.dev

How the Trivy supply chain attack harvested credentials from secrets managers

vaultproof.dev

RSS BotMB to Hacker NewsEnglish · 4 months ago

The Trivy Attack Revealed a Blind Spot in Every Secrets Manager

vaultproof.dev

Trivy v0.69.4 silently harvested credentials from thousands of CI/CD pipelines. The secrets managers didn't help. Here's why — and what does.

Comments

You must log in or # to comment.

Chat

Hacker News

hackernews

You are not logged in. However you can subscribe from another Fediverse account, for example Lemmy or Mastodon. To do this, paste the following into the search field of your instance: !hackernews@lemmy.bestiver.se

Community locked: only moderators can create posts. You can still comment on posts.

Posts from the RSS Feed of HackerNews.

The feed sometimes contains ads and posts that have been removed by the mod team at HN.

Source of the RSS Bot

Visibility: Public

This community can be federated to other instances and be posted/commented in by their users.

591 users / day
1.64K users / week
3.66K users / month
9.69K users / 6 months
2 local subscribers
5.28K subscribers
58.5K Posts
31.3K Comments
Modlog