最新のセキュリティ情報
9月21日(月)
GitHub Actions leaking secrets when Miri output is cached
The Rust Security Response Team was notified that Miri stores all environment variables to target/ , allowing secrets to persist in caches. While not necessary a vulnerability in and of itself, when paired with GitHub Actions caching behavior, it is possible for this to expose secrets to PRs. Overview GitHub Actions makes it possible to cache directories between runs. Typical setups allow CI runs on main (and other branches) to write to cache, and PRs can only read from cache (preventing cache poisoning). Rust projects tend to speed up CI by caching binaries built by cargo install and sometim…
6月13日(月)
Vapor: GitHub Integration + Scaffolding
Today, we are excited to announce that you may create Vapor projects by simply connecting your GitHub account and letting Vapor do the rest! Need more details? Here's what we mean. Starting today, Vapor can create a new GitHub repository, deploy the new application to Vapor, and configure GitHub actions to deploy to Vapor each time you push fresh code to your new application.