Gheist: 13,500 secret-dumping workflows planted with stolen GitHub tokens — audit yours in 5 minutes
Since September, a campaign called Gheist planted 13,500 secret-dumping workflows with stolen GitHub tokens — base32 defeats log masking, permissions:{} protects nothing, and the exfil channel is GitHub itself. The audit that tells you in 5 minutes if you were hit.
🎯 Vulnerability: Web Security Vulnerability
💡 Defense Fix: Implement strict input validation, contextual output encoding, and enforce least-privilege authorization controls.