Evidence search
Search
Search titles, summaries, topics, providers, authors, and the full open-access corpus.
Results for “OIDC”
17 publicationsStop pull_request_target workflows from running fork code
GitHub blocks pull_request_target in public repositories by default from November 2, 2026. Find the workflows that run fork code with secrets, split them, pin a checkout that refuses unsafe refs, and allow the rest deliberately.
Workload security · GitHub · By Cloud Security DeskRun AI coding agents in GitHub Actions without exposing secrets
Treat the agent job as an untrusted-input processor. Follow the outside text from the trigger that admits it to the credentials it can reach, then split reading from writing so a successful injection reaches nothing worth stealing.
AI systems · GitHub / Anthropic / Google / Microsoft · By Cloud Security DeskKnow what service mesh mTLS proves about the caller
A mesh handshake proves that a peer held a key for a namespace and service account. It says nothing about the user or the operation, and permissive defaults, probes and waypoints open paths around it.
Workload security · Istio / Linkerd / Kubernetes / Google Cloud / Microsoft Azure / Amazon Web Services · By Cloud Security DeskFind the AWS global control planes in your recovery path
Thirteen AWS control planes run in us-east-1 or us-west-2, and ordinary calls from other Regions still reach them. Audit runbooks, SDK settings and the last exercise, then swap each dependency for a data-plane operation.
Resilience · Amazon Web Services · By Cloud Security DeskGive Kubernetes pods cloud credentials without static keys
EKS Pod Identity, IRSA, AKS Workload ID and Workload Identity Federation for GKE all swap a projected token for short-lived credentials. What leaks if you stop there is the node's own identity.
Identity & access · Amazon Web Services / Microsoft Azure / Google Cloud / Kubernetes · By Cloud Security DeskPrepare Azure automation for mandatory MFA on resource management
Azure now requires MFA for user accounts that write through Resource Manager. Find the scripts and pipelines that still sign in as people and move each one to a managed identity or federated credential.
Identity & access · Microsoft Azure / Microsoft Entra / GitHub / Azure DevOps / HashiCorp Terraform · By Cloud Security DeskPin third-party GitHub Actions and limit what they can reach
A tag can be moved under your workflow overnight. Pin every action to a commit SHA, enforce it across the organization, and cut the token and secret access a malicious action would inherit.
Workload security · GitHub / OpenSSF / CISA · By Cloud Security DeskInvestigate a CI supply chain compromise from workflow logs to rotated secrets
When an action or package in your pipeline turns out to be malicious, scope the response by exposure window and by what each affected job could reach, then revoke together and hunt for use.
Detection & response · GitHub / AWS / npm · By Cloud Security DeskPublish npm packages with trusted publishing instead of long-lived tokens
npm revoked classic tokens and capped write tokens at 90 days. Move CI releases to trusted publishing with staged approval, then protect the workflow, tags and environment that now hold publish authority.
Workload security · npm / GitHub / GitLab / CircleCI / Sigstore · By Cloud Security DeskBuild an inventory of non-human identities across cloud accounts
Find every service account, service principal, role and key across AWS, Entra and Google Cloud, then record the owner, credential type, privilege and last use that turn a list into decisions.
Identity & access · Amazon Web Services / Microsoft Entra / Microsoft Azure / Google Cloud / OWASP · By Cloud Security DeskLet AWS workloads call external services with IAM-issued tokens
IAM outbound identity federation lets an AWS role trade its credentials for a signed JWT instead of storing a vendor API key. AWS controls issuance; the receiving service's claim checks decide what the token is worth.
Identity & access · Amazon Web Services / AWS IAM / AWS STS / Microsoft Entra · By Cloud Security DeskBack up a Kubernetes cluster so workloads can actually be restored
A Kubernetes backup has to carry definitions, Secrets and volume data, and the restore depends on identity, keys and images it never held. Plan the layers, the restore order and the checks that prove recovery.
Resilience · Kubernetes / Velero / Amazon Web Services / Google Cloud / Microsoft Azure · By Cloud Security DeskKeep GitHub audit streaming continuous across maintenance
Plan audit-stream maintenance around native history, pause buffers, receiver acceptance and duplicate-aware evidence receipts.
Detection & response · GitHub / AWS · By Cloud Security DeskWorkload federation across clouds needs separate trust decisions
Cross-cloud federation adds trust decisions, not a portable permission system. Map each credential and resource grant before moving a runtime workload.
Identity & access · AWS / Google Cloud / Microsoft Entra · By Cloud Security DeskTurn SBOM and VEX records into patch decisions
A VEX statement is an assertion about a specific product and vulnerability. Match its scope and conditions before using it to suppress a finding.
Workload security · CISA / OpenVEX / CycloneDX / OASIS · By Cloud Security DeskVerify container provenance before admitting a pinned image
Use the digest to identify the artifact, then check who signed it, which builder produced it, and which evidence survived promotion into the deployment registry.
Workload security · Kubernetes / Docker / Sigstore · By Cloud Security DeskLock GitHub deployment trust to the job you intend
A short-lived token still needs a narrow trust decision. Review the subject, deployment environment, reusable workflow and AWS role together.
Identity & access · AWS / GitHub · By Cloud Security Desk